/usr/src/usr.bin/ssh/ssh-keysign/../sshkey.c

Bug Summary

File:	src/usr.bin/ssh/ssh-keysign/../sshkey.c
Warning:	line 2189, column 25 Access to field 'certblob' results in a dereference of a null pointer (loaded from field 'cert')
Annotated Source Code

Press '?' to see keyboard shortcuts
Show analyzer invocation
clang -cc1 -cc1 -triple amd64-unknown-openbsd7.0 -analyze -disable-free -disable-llvm-verifier -discard-value-names -main-file-name sshkey.c -analyzer-store=region -analyzer-opt-analyze-nested-blocks -analyzer-checker=core -analyzer-checker=apiModeling -analyzer-checker=unix -analyzer-checker=deadcode -analyzer-checker=security.insecureAPI.UncheckedReturn -analyzer-checker=security.insecureAPI.getpw -analyzer-checker=security.insecureAPI.gets -analyzer-checker=security.insecureAPI.mktemp -analyzer-checker=security.insecureAPI.mkstemp -analyzer-checker=security.insecureAPI.vfork -analyzer-checker=nullability.NullPassedToNonnull -analyzer-checker=nullability.NullReturnedFromNonnull -analyzer-output plist -w -setup-static-analyzer -mrelocation-model pic -pic-level 1 -pic-is-pie -mframe-pointer=all -relaxed-aliasing -fno-rounding-math -mconstructor-aliases -munwind-tables -target-cpu x86-64 -target-feature +retpoline-indirect-calls -target-feature +retpoline-indirect-branches -tune-cpu generic -debugger-tuning=gdb -fcoverage-compilation-dir=/usr/src/usr.bin/ssh/ssh-keysign/obj -resource-dir /usr/local/lib/clang/13.0.0 -I /usr/src/usr.bin/ssh/ssh-keysign/.. -D WITH_OPENSSL -D WITH_ZLIB -D ENABLE_PKCS11 -D HAVE_DLOPEN -internal-isystem /usr/local/lib/clang/13.0.0/include -internal-externc-isystem /usr/include -O2 -Wno-unused-parameter -fdebug-compilation-dir=/usr/src/usr.bin/ssh/ssh-keysign/obj -ferror-limit 19 -fwrapv -D_RET_PROTECTOR -ret-protector -fgnuc-version=4.2.1 -vectorize-loops -vectorize-slp -fno-builtin-malloc -fno-builtin-calloc -fno-builtin-realloc -fno-builtin-valloc -fno-builtin-free -fno-builtin-strdup -fno-builtin-strndup -analyzer-output=html -faddrsig -D__GCC_HAVE_DWARF2_CFI_ASM=1 -o /home/ben/Projects/vmm/scan-build/2022-01-12-194120-40624-1 -x c /usr/src/usr.bin/ssh/ssh-keysign/../sshkey.c
1/* $OpenBSD: sshkey.c,v 1.120 2022/01/06 22:05:42 djm Exp $ */
2/*
* Copyright (c) 2000, 2001 Markus Friedl.  All rights reserved.
* Copyright (c) 2008 Alexander von Gernler.  All rights reserved.
* Copyright (c) 2010,2011 Damien Miller.  All rights reserved.
*
* Redistribution and use in source and binary forms, with or without
* modification, are permitted provided that the following conditions
* are met:
* 1. Redistributions of source code must retain the above copyright
*    notice, this list of conditions and the following disclaimer.
* 2. Redistributions in binary form must reproduce the above copyright
*    notice, this list of conditions and the following disclaimer in the
*    documentation and/or other materials provided with the distribution.
*
* THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR
* IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES
* OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED.
* IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT,
* INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
* NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
* DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
* THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
* (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
* THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
*/

28#include <sys/types.h>
29#include <netinet/in.h>

31#ifdef WITH_OPENSSL1
32#include <openssl/evp.h>
33#include <openssl/err.h>
34#include <openssl/pem.h>
35#endif

37#include "crypto_api.h"

39#include <errno(*__errno()).h>
40#include <stdio.h>
41#include <string.h>
42#include <util.h>
43#include <limits.h>
44#include <resolv.h>

46#include "ssh2.h"
47#include "ssherr.h"
48#include "misc.h"
49#include "sshbuf.h"
50#include "cipher.h"
51#include "digest.h"
52#define SSHKEY_INTERNAL
53#include "sshkey.h"
54#include "match.h"
55#include "ssh-sk.h"

57#ifdef WITH_XMSS
58#include "sshkey-xmss.h"
59#include "xmss_fast.h"
60#endif

62/* openssh private key file format */
63#define MARK_BEGIN"-----BEGIN OPENSSH PRIVATE KEY-----\n"		"-----BEGIN OPENSSH PRIVATE KEY-----\n"
64#define MARK_END"-----END OPENSSH PRIVATE KEY-----\n"		"-----END OPENSSH PRIVATE KEY-----\n"
65#define MARK_BEGIN_LEN(sizeof("-----BEGIN OPENSSH PRIVATE KEY-----\n") - 1)		(sizeof(MARK_BEGIN"-----BEGIN OPENSSH PRIVATE KEY-----\n") - 1)
66#define MARK_END_LEN(sizeof("-----END OPENSSH PRIVATE KEY-----\n") - 1)		(sizeof(MARK_END"-----END OPENSSH PRIVATE KEY-----\n") - 1)
67#define KDFNAME"bcrypt"			"bcrypt"
68#define AUTH_MAGIC"openssh-key-v1"		"openssh-key-v1"
69#define SALT_LEN16		16
70#define DEFAULT_CIPHERNAME"aes256-ctr"	"aes256-ctr"
71#define	DEFAULT_ROUNDS16		16

73/* Version identification string for SSH v1 identity files. */
74#define LEGACY_BEGIN"SSH PRIVATE KEY FILE FORMAT 1.1\n"		"SSH PRIVATE KEY FILE FORMAT 1.1\n"

76/*
* Constants relating to "shielding" support; protection of keys expected
* to remain in memory for long durations
*/
80#define SSHKEY_SHIELD_PREKEY_LEN(16 * 1024)	(16 * 1024)
81#define SSHKEY_SHIELD_CIPHER"aes256-ctr"		"aes256-ctr" /* XXX want AES-EME* */
82#define SSHKEY_SHIELD_PREKEY_HASH4	SSH_DIGEST_SHA5124

84int	sshkey_private_serialize_opt(struct sshkey *key,
  struct sshbuf *buf, enum sshkey_serialize_rep);
86static int sshkey_from_blob_internal(struct sshbuf *buf,
  struct sshkey **keyp, int allow_cert);

89/* Supported key types */
90struct keytype {
const char *name;
const char *shortname;
const char *sigalg;
int type;
int nid;
int cert;
int sigonly;
98};
99static const struct keytype keytypes[] = {
{ "ssh-ed25519", "ED25519", NULL((void*)0), KEY_ED25519, 0, 0, 0 },
{ "ssh-ed25519-cert-v01@openssh.com", "ED25519-CERT", NULL((void*)0),
   KEY_ED25519_CERT, 0, 1, 0 },
{ "sk-ssh-ed25519@openssh.com", "ED25519-SK", NULL((void*)0),
   KEY_ED25519_SK, 0, 0, 0 },
{ "sk-ssh-ed25519-cert-v01@openssh.com", "ED25519-SK-CERT", NULL((void*)0),
   KEY_ED25519_SK_CERT, 0, 1, 0 },
107#ifdef WITH_XMSS
{ "ssh-xmss@openssh.com", "XMSS", NULL((void*)0), KEY_XMSS, 0, 0, 0 },
{ "ssh-xmss-cert-v01@openssh.com", "XMSS-CERT", NULL((void*)0),
   KEY_XMSS_CERT, 0, 1, 0 },
111#endif /* WITH_XMSS */
112#ifdef WITH_OPENSSL1
{ "ssh-rsa", "RSA", NULL((void*)0), KEY_RSA, 0, 0, 0 },
{ "rsa-sha2-256", "RSA", NULL((void*)0), KEY_RSA, 0, 0, 1 },
{ "rsa-sha2-512", "RSA", NULL((void*)0), KEY_RSA, 0, 0, 1 },
{ "ssh-dss", "DSA", NULL((void*)0), KEY_DSA, 0, 0, 0 },
{ "ecdsa-sha2-nistp256", "ECDSA", NULL((void*)0),
   KEY_ECDSA, NID_X9_62_prime256v1415, 0, 0 },
{ "ecdsa-sha2-nistp384", "ECDSA", NULL((void*)0),
   KEY_ECDSA, NID_secp384r1715, 0, 0 },
{ "ecdsa-sha2-nistp521", "ECDSA", NULL((void*)0),
   KEY_ECDSA, NID_secp521r1716, 0, 0 },
{ "sk-ecdsa-sha2-nistp256@openssh.com", "ECDSA-SK", NULL((void*)0),
   KEY_ECDSA_SK, NID_X9_62_prime256v1415, 0, 0 },
{ "webauthn-sk-ecdsa-sha2-nistp256@openssh.com", "ECDSA-SK", NULL((void*)0),
   KEY_ECDSA_SK, NID_X9_62_prime256v1415, 0, 1 },
{ "ssh-rsa-cert-v01@openssh.com", "RSA-CERT", NULL((void*)0),
   KEY_RSA_CERT, 0, 1, 0 },
{ "rsa-sha2-256-cert-v01@openssh.com", "RSA-CERT",
   "rsa-sha2-256", KEY_RSA_CERT, 0, 1, 1 },
{ "rsa-sha2-512-cert-v01@openssh.com", "RSA-CERT",
   "rsa-sha2-512", KEY_RSA_CERT, 0, 1, 1 },
{ "ssh-dss-cert-v01@openssh.com", "DSA-CERT", NULL((void*)0),
   KEY_DSA_CERT, 0, 1, 0 },
{ "ecdsa-sha2-nistp256-cert-v01@openssh.com", "ECDSA-CERT", NULL((void*)0),
   KEY_ECDSA_CERT, NID_X9_62_prime256v1415, 1, 0 },
{ "ecdsa-sha2-nistp384-cert-v01@openssh.com", "ECDSA-CERT", NULL((void*)0),
   KEY_ECDSA_CERT, NID_secp384r1715, 1, 0 },
{ "ecdsa-sha2-nistp521-cert-v01@openssh.com", "ECDSA-CERT", NULL((void*)0),
   KEY_ECDSA_CERT, NID_secp521r1716, 1, 0 },
{ "sk-ecdsa-sha2-nistp256-cert-v01@openssh.com", "ECDSA-SK-CERT", NULL((void*)0),
   KEY_ECDSA_SK_CERT, NID_X9_62_prime256v1415, 1, 0 },
143#endif /* WITH_OPENSSL */
{ NULL((void*)0), NULL((void*)0), NULL((void*)0), -1, -1, 0, 0 }
145};

147const char *
148sshkey_type(const struct sshkey *k)
149{
const struct keytype *kt;

for (kt = keytypes; kt->type != -1; kt++) {
if (kt->type == k->type)
	return kt->shortname;
}
return "unknown";
157}

159static const char *
160sshkey_ssh_name_from_type_nid(int type, int nid)
161{
const struct keytype *kt;

for (kt = keytypes; kt->type != -1; kt++) {
if (kt->type == type && (kt->nid == 0 || kt->nid == nid))
	return kt->name;
}
return "ssh-unknown";
169}

171int
172sshkey_type_is_cert(int type)
173{
const struct keytype *kt;

for (kt = keytypes; kt->type != -1; kt++) {
if (kt->type == type)
	return kt->cert;
}
return 0;
181}

183const char *
184sshkey_ssh_name(const struct sshkey *k)
185{
return sshkey_ssh_name_from_type_nid(k->type, k->ecdsa_nid);
187}

189const char *
190sshkey_ssh_name_plain(const struct sshkey *k)
191{
return sshkey_ssh_name_from_type_nid(sshkey_type_plain(k->type),
   k->ecdsa_nid);
194}

196int
197sshkey_type_from_name(const char *name)
198{
const struct keytype *kt;

for (kt = keytypes; kt->type != -1; kt++) {
/* Only allow shortname matches for plain key types */
if ((kt->name != NULL((void*)0) && strcmp(name, kt->name) == 0) ||
    (!kt->cert && strcasecmp(kt->shortname, name) == 0))
	return kt->type;
}
return KEY_UNSPEC;
208}

210static int
211key_type_is_ecdsa_variant(int type)
212{
switch (type) {
case KEY_ECDSA:
case KEY_ECDSA_CERT:
case KEY_ECDSA_SK:
case KEY_ECDSA_SK_CERT:
return 1;
}
return 0;
221}

223int
224sshkey_ecdsa_nid_from_name(const char *name)
225{
const struct keytype *kt;

for (kt = keytypes; kt->type != -1; kt++) {
if (!key_type_is_ecdsa_variant(kt->type))
	continue;
if (kt->name != NULL((void*)0) && strcmp(name, kt->name) == 0)
	return kt->nid;
}
return -1;
235}

237int
238sshkey_match_keyname_to_sigalgs(const char *keyname, const char *sigalgs)
239{
int ktype;

if (sigalgs == NULL((void*)0) || *sigalgs == '\0' ||
   (ktype = sshkey_type_from_name(keyname)) == KEY_UNSPEC)
return 0;
else if (ktype == KEY_RSA) {
return match_pattern_list("ssh-rsa", sigalgs, 0) == 1 ||
    match_pattern_list("rsa-sha2-256", sigalgs, 0) == 1 ||
    match_pattern_list("rsa-sha2-512", sigalgs, 0) == 1;
} else if (ktype == KEY_RSA_CERT) {
return match_pattern_list("ssh-rsa-cert-v01@openssh.com",
    sigalgs, 0) == 1 ||
    match_pattern_list("rsa-sha2-256-cert-v01@openssh.com",
    sigalgs, 0) == 1 ||
    match_pattern_list("rsa-sha2-512-cert-v01@openssh.com",
    sigalgs, 0) == 1;
} else
return match_pattern_list(keyname, sigalgs, 0) == 1;
258}

260char *
261sshkey_alg_list(int certs_only, int plain_only, int include_sigonly, char sep)
262{
char *tmp, *ret = NULL((void*)0);
size_t nlen, rlen = 0;
const struct keytype *kt;

for (kt = keytypes; kt->type != -1; kt++) {
if (kt->name == NULL((void*)0))
	continue;
if (!include_sigonly && kt->sigonly)
	continue;
if ((certs_only && !kt->cert) || (plain_only && kt->cert))
	continue;
if (ret != NULL((void*)0))
	ret[rlen++] = sep;
nlen = strlen(kt->name);
if ((tmp = realloc(ret, rlen + nlen + 2)) == NULL((void*)0)) {
	free(ret);
	return NULL((void*)0);
}
ret = tmp;
memcpy(ret + rlen, kt->name, nlen + 1);
rlen += nlen;
}
return ret;
286}

288int
289sshkey_names_valid2(const char *names, int allow_wildcard)
290{
char *s, *cp, *p;
const struct keytype *kt;
int type;

if (names == NULL((void*)0) || strcmp(names, "") == 0)
return 0;
if ((s = cp = strdup(names)) == NULL((void*)0))
return 0;
for ((p = strsep(&cp, ",")); p && *p != '\0';
   (p = strsep(&cp, ","))) {
type = sshkey_type_from_name(p);
if (type == KEY_UNSPEC) {
	if (allow_wildcard) {
		/*
		 * Try matching key types against the string.
		 * If any has a positive or negative match then
		 * the component is accepted.
		 */
		for (kt = keytypes; kt->type != -1; kt++) {
			if (match_pattern_list(kt->name,
			    p, 0) != 0)
				break;
		}
		if (kt->type != -1)
			continue;
	}
	free(s);
	return 0;
}
}
free(s);
return 1;
323}

325u_int
326sshkey_size(const struct sshkey *k)
327{
328#ifdef WITH_OPENSSL1
const BIGNUM *rsa_n, *dsa_p;
330#endif /* WITH_OPENSSL */

switch (k->type) {
333#ifdef WITH_OPENSSL1
case KEY_RSA:
case KEY_RSA_CERT:
if (k->rsa == NULL((void*)0))
	return 0;
RSA_get0_key(k->rsa, &rsa_n, NULL((void*)0), NULL((void*)0));
return BN_num_bits(rsa_n);
case KEY_DSA:
case KEY_DSA_CERT:
if (k->dsa == NULL((void*)0))
	return 0;
DSA_get0_pqg(k->dsa, &dsa_p, NULL((void*)0), NULL((void*)0));
return BN_num_bits(dsa_p);
case KEY_ECDSA:
case KEY_ECDSA_CERT:
case KEY_ECDSA_SK:
case KEY_ECDSA_SK_CERT:
return sshkey_curve_nid_to_bits(k->ecdsa_nid);
351#endif /* WITH_OPENSSL */
case KEY_ED25519:
case KEY_ED25519_CERT:
case KEY_ED25519_SK:
case KEY_ED25519_SK_CERT:
case KEY_XMSS:
case KEY_XMSS_CERT:
return 256;	/* XXX */
}
return 0;
361}

363static int
364sshkey_type_is_valid_ca(int type)
365{
switch (type) {
case KEY_RSA:
case KEY_DSA:
case KEY_ECDSA:
case KEY_ECDSA_SK:
case KEY_ED25519:
case KEY_ED25519_SK:
case KEY_XMSS:
return 1;
default:
return 0;
}
378}

380int
381sshkey_is_cert(const struct sshkey *k)
382{
if (k == NULL((void*)0))
return 0;
return sshkey_type_is_cert(k->type);
386}

388int
389sshkey_is_sk(const struct sshkey *k)
390{
if (k == NULL((void*)0))
return 0;
switch (sshkey_type_plain(k->type)) {
case KEY_ECDSA_SK:
case KEY_ED25519_SK:
return 1;
default:
return 0;
}
400}

402/* Return the cert-less equivalent to a certified key type */
403int
404sshkey_type_plain(int type)
405{
switch (type) {
case KEY_RSA_CERT:
return KEY_RSA;
case KEY_DSA_CERT:
return KEY_DSA;
case KEY_ECDSA_CERT:
return KEY_ECDSA;
case KEY_ECDSA_SK_CERT:
return KEY_ECDSA_SK;
case KEY_ED25519_CERT:
return KEY_ED25519;
case KEY_ED25519_SK_CERT:
return KEY_ED25519_SK;
case KEY_XMSS_CERT:
return KEY_XMSS;
default:
return type;
}
424}

426#ifdef WITH_OPENSSL1
427/* XXX: these are really begging for a table-driven approach */
428int
429sshkey_curve_name_to_nid(const char *name)
430{
if (strcmp(name, "nistp256") == 0)
return NID_X9_62_prime256v1415;
else if (strcmp(name, "nistp384") == 0)
return NID_secp384r1715;
else if (strcmp(name, "nistp521") == 0)
return NID_secp521r1716;
else
return -1;
439}

441u_int
442sshkey_curve_nid_to_bits(int nid)
443{
switch (nid) {
case NID_X9_62_prime256v1415:
return 256;
case NID_secp384r1715:
return 384;
case NID_secp521r1716:
return 521;
default:
return 0;
}
454}

456int
457sshkey_ecdsa_bits_to_nid(int bits)
458{
switch (bits) {
case 256:
return NID_X9_62_prime256v1415;
case 384:
return NID_secp384r1715;
case 521:
return NID_secp521r1716;
default:
return -1;
}
469}

471const char *
472sshkey_curve_nid_to_name(int nid)
473{
switch (nid) {
case NID_X9_62_prime256v1415:
return "nistp256";
case NID_secp384r1715:
return "nistp384";
case NID_secp521r1716:
return "nistp521";
default:
return NULL((void*)0);
}
484}

486int
487sshkey_ec_nid_to_hash_alg(int nid)
488{
int kbits = sshkey_curve_nid_to_bits(nid);

if (kbits <= 0)
return -1;

/* RFC5656 section 6.2.1 */
if (kbits <= 256)
return SSH_DIGEST_SHA2562;
else if (kbits <= 384)
return SSH_DIGEST_SHA3843;
else
return SSH_DIGEST_SHA5124;
501}
502#endif /* WITH_OPENSSL */

504static void
505cert_free(struct sshkey_cert *cert)
506{
u_int i;

if (cert == NULL((void*)0))
return;
sshbuf_free(cert->certblob);
sshbuf_free(cert->critical);
sshbuf_free(cert->extensions);
free(cert->key_id);
for (i = 0; i < cert->nprincipals; i++)
free(cert->principals[i]);
free(cert->principals);
sshkey_free(cert->signature_key);
free(cert->signature_type);
freezero(cert, sizeof(*cert));
521}

523static struct sshkey_cert *
524cert_new(void)
525{
struct sshkey_cert *cert;

if ((cert = calloc(1, sizeof(*cert))) == NULL((void*)0))
return NULL((void*)0);
if ((cert->certblob = sshbuf_new()) == NULL((void*)0) ||
   (cert->critical = sshbuf_new()) == NULL((void*)0) ||
   (cert->extensions = sshbuf_new()) == NULL((void*)0)) {
cert_free(cert);
return NULL((void*)0);
}
cert->key_id = NULL((void*)0);
cert->principals = NULL((void*)0);
cert->signature_key = NULL((void*)0);
cert->signature_type = NULL((void*)0);
return cert;
541}

543struct sshkey *
544sshkey_new(int type)
545{
struct sshkey *k;
547#ifdef WITH_OPENSSL1
RSA *rsa;
DSA *dsa;
550#endif /* WITH_OPENSSL */

if ((k = calloc(1, sizeof(*k))) == NULL((void*)0))
29
←
Assuming the condition is false→
30
←
Taking false branch→
return NULL((void*)0);
k->type = type;
k->ecdsa = NULL((void*)0);
k->ecdsa_nid = -1;
k->dsa = NULL((void*)0);
k->rsa = NULL((void*)0);
k->cert = NULL((void*)0);
31
←
Null pointer value stored to field 'cert'→
k->ed25519_sk = NULL((void*)0);
k->ed25519_pk = NULL((void*)0);
k->xmss_sk = NULL((void*)0);
k->xmss_pk = NULL((void*)0);
switch (k->type) {
32
←
Control jumps to 'case KEY_ED25519:'  at line 589→
565#ifdef WITH_OPENSSL1
case KEY_RSA:
case KEY_RSA_CERT:
if ((rsa = RSA_new()) == NULL((void*)0)) {
	free(k);
	return NULL((void*)0);
}
k->rsa = rsa;
break;
case KEY_DSA:
case KEY_DSA_CERT:
if ((dsa = DSA_new()) == NULL((void*)0)) {
	free(k);
	return NULL((void*)0);
}
k->dsa = dsa;
break;
case KEY_ECDSA:
case KEY_ECDSA_CERT:
case KEY_ECDSA_SK:
case KEY_ECDSA_SK_CERT:
/* Cannot do anything until we know the group */
break;
588#endif /* WITH_OPENSSL */
case KEY_ED25519:
case KEY_ED25519_CERT:
case KEY_ED25519_SK:
case KEY_ED25519_SK_CERT:
case KEY_XMSS:
case KEY_XMSS_CERT:
/* no need to prealloc */
break;
33
←
 Execution continues on line 604→
case KEY_UNSPEC:
break;
default:
free(k);
return NULL((void*)0);
}

if (sshkey_is_cert(k)) {
34
←
Assuming the condition is false→
35
←
Taking false branch→
if ((k->cert = cert_new()) == NULL((void*)0)) {
	sshkey_free(k);
	return NULL((void*)0);
}
}

return k;
612}

614void
615sshkey_free(struct sshkey *k)
616{
if (k == NULL((void*)0))
return;
switch (k->type) {
620#ifdef WITH_OPENSSL1
case KEY_RSA:
case KEY_RSA_CERT:
RSA_free(k->rsa);
k->rsa = NULL((void*)0);
break;
case KEY_DSA:
case KEY_DSA_CERT:
DSA_free(k->dsa);
k->dsa = NULL((void*)0);
break;
case KEY_ECDSA_SK:
case KEY_ECDSA_SK_CERT:
free(k->sk_application);
sshbuf_free(k->sk_key_handle);
sshbuf_free(k->sk_reserved);
/* FALLTHROUGH */
case KEY_ECDSA:
case KEY_ECDSA_CERT:
EC_KEY_free(k->ecdsa);
k->ecdsa = NULL((void*)0);
break;
642#endif /* WITH_OPENSSL */
case KEY_ED25519_SK:
case KEY_ED25519_SK_CERT:
free(k->sk_application);
sshbuf_free(k->sk_key_handle);
sshbuf_free(k->sk_reserved);
/* FALLTHROUGH */
case KEY_ED25519:
case KEY_ED25519_CERT:
freezero(k->ed25519_pk, ED25519_PK_SZ32U);
k->ed25519_pk = NULL((void*)0);
freezero(k->ed25519_sk, ED25519_SK_SZ64U);
k->ed25519_sk = NULL((void*)0);
break;
656#ifdef WITH_XMSS
case KEY_XMSS:
case KEY_XMSS_CERT:
freezero(k->xmss_pk, sshkey_xmss_pklen(k));
k->xmss_pk = NULL((void*)0);
freezero(k->xmss_sk, sshkey_xmss_sklen(k));
k->xmss_sk = NULL((void*)0);
sshkey_xmss_free_state(k);
free(k->xmss_name);
k->xmss_name = NULL((void*)0);
free(k->xmss_filename);
k->xmss_filename = NULL((void*)0);
break;
669#endif /* WITH_XMSS */
case KEY_UNSPEC:
break;
default:
break;
}
if (sshkey_is_cert(k))
cert_free(k->cert);
freezero(k->shielded_private, k->shielded_len);
freezero(k->shield_prekey, k->shield_prekey_len);
freezero(k, sizeof(*k));
680}

682static int
683cert_compare(struct sshkey_cert *a, struct sshkey_cert *b)
684{
if (a == NULL((void*)0) && b == NULL((void*)0))
return 1;
if (a == NULL((void*)0) || b == NULL((void*)0))
return 0;
if (sshbuf_len(a->certblob) != sshbuf_len(b->certblob))
return 0;
if (timingsafe_bcmp(sshbuf_ptr(a->certblob), sshbuf_ptr(b->certblob),
   sshbuf_len(a->certblob)) != 0)
return 0;
return 1;
695}

697/*
* Compare public portions of key only, allowing comparisons between
* certificates and plain keys too.
*/
701int
702sshkey_equal_public(const struct sshkey *a, const struct sshkey *b)
703{
704#ifdef WITH_OPENSSL1
const BIGNUM *rsa_e_a, *rsa_n_a;
const BIGNUM *rsa_e_b, *rsa_n_b;
const BIGNUM *dsa_p_a, *dsa_q_a, *dsa_g_a, *dsa_pub_key_a;
const BIGNUM *dsa_p_b, *dsa_q_b, *dsa_g_b, *dsa_pub_key_b;
709#endif /* WITH_OPENSSL */

if (a == NULL((void*)0) || b == NULL((void*)0) ||
   sshkey_type_plain(a->type) != sshkey_type_plain(b->type))
return 0;

switch (a->type) {
716#ifdef WITH_OPENSSL1
case KEY_RSA_CERT:
case KEY_RSA:
if (a->rsa == NULL((void*)0) || b->rsa == NULL((void*)0))
	return 0;
RSA_get0_key(a->rsa, &rsa_n_a, &rsa_e_a, NULL((void*)0));
RSA_get0_key(b->rsa, &rsa_n_b, &rsa_e_b, NULL((void*)0));
return BN_cmp(rsa_e_a, rsa_e_b) == 0 &&
    BN_cmp(rsa_n_a, rsa_n_b) == 0;
case KEY_DSA_CERT:
case KEY_DSA:
if (a->dsa == NULL((void*)0) || b->dsa == NULL((void*)0))
	return 0;
DSA_get0_pqg(a->dsa, &dsa_p_a, &dsa_q_a, &dsa_g_a);
DSA_get0_pqg(b->dsa, &dsa_p_b, &dsa_q_b, &dsa_g_b);
DSA_get0_key(a->dsa, &dsa_pub_key_a, NULL((void*)0));
DSA_get0_key(b->dsa, &dsa_pub_key_b, NULL((void*)0));
return BN_cmp(dsa_p_a, dsa_p_b) == 0 &&
    BN_cmp(dsa_q_a, dsa_q_b) == 0 &&
    BN_cmp(dsa_g_a, dsa_g_b) == 0 &&
    BN_cmp(dsa_pub_key_a, dsa_pub_key_b) == 0;
case KEY_ECDSA_SK:
case KEY_ECDSA_SK_CERT:
if (a->sk_application == NULL((void*)0) || b->sk_application == NULL((void*)0))
	return 0;
if (strcmp(a->sk_application, b->sk_application) != 0)
	return 0;
/* FALLTHROUGH */
case KEY_ECDSA_CERT:
case KEY_ECDSA:
if (a->ecdsa == NULL((void*)0) || b->ecdsa == NULL((void*)0) ||
    EC_KEY_get0_public_key(a->ecdsa) == NULL((void*)0) ||
    EC_KEY_get0_public_key(b->ecdsa) == NULL((void*)0))
	return 0;
if (EC_GROUP_cmp(EC_KEY_get0_group(a->ecdsa),
    EC_KEY_get0_group(b->ecdsa), NULL((void*)0)) != 0 ||
    EC_POINT_cmp(EC_KEY_get0_group(a->ecdsa),
    EC_KEY_get0_public_key(a->ecdsa),
    EC_KEY_get0_public_key(b->ecdsa), NULL((void*)0)) != 0)
	return 0;
return 1;
757#endif /* WITH_OPENSSL */
case KEY_ED25519_SK:
case KEY_ED25519_SK_CERT:
if (a->sk_application == NULL((void*)0) || b->sk_application == NULL((void*)0))
	return 0;
if (strcmp(a->sk_application, b->sk_application) != 0)
	return 0;
/* FALLTHROUGH */
case KEY_ED25519:
case KEY_ED25519_CERT:
return a->ed25519_pk != NULL((void*)0) && b->ed25519_pk != NULL((void*)0) &&
    memcmp(a->ed25519_pk, b->ed25519_pk, ED25519_PK_SZ32U) == 0;
769#ifdef WITH_XMSS
case KEY_XMSS:
case KEY_XMSS_CERT:
return a->xmss_pk != NULL((void*)0) && b->xmss_pk != NULL((void*)0) &&
    sshkey_xmss_pklen(a) == sshkey_xmss_pklen(b) &&
    memcmp(a->xmss_pk, b->xmss_pk, sshkey_xmss_pklen(a)) == 0;
775#endif /* WITH_XMSS */
default:
return 0;
}
/* NOTREACHED */
780}

782int
783sshkey_equal(const struct sshkey *a, const struct sshkey *b)
784{
if (a == NULL((void*)0) || b == NULL((void*)0) || a->type != b->type)
return 0;
if (sshkey_is_cert(a)) {
if (!cert_compare(a->cert, b->cert))
	return 0;
}
return sshkey_equal_public(a, b);
792}

794static int
795to_blob_buf(const struct sshkey *key, struct sshbuf *b, int force_plain,
enum sshkey_serialize_rep opts)
797{
int type, ret = SSH_ERR_INTERNAL_ERROR-1;
const char *typename;
800#ifdef WITH_OPENSSL1
const BIGNUM *rsa_n, *rsa_e, *dsa_p, *dsa_q, *dsa_g, *dsa_pub_key;
802#endif /* WITH_OPENSSL */

if (key == NULL((void*)0))
return SSH_ERR_INVALID_ARGUMENT-10;

if (sshkey_is_cert(key)) {
if (key->cert == NULL((void*)0))
	return SSH_ERR_EXPECTED_CERT-16;
if (sshbuf_len(key->cert->certblob) == 0)
	return SSH_ERR_KEY_LACKS_CERTBLOB-17;
}
type = force_plain ? sshkey_type_plain(key->type) : key->type;
typename = sshkey_ssh_name_from_type_nid(type, key->ecdsa_nid);

switch (type) {
817#ifdef WITH_OPENSSL1
case KEY_DSA_CERT:
case KEY_ECDSA_CERT:
case KEY_ECDSA_SK_CERT:
case KEY_RSA_CERT:
822#endif /* WITH_OPENSSL */
case KEY_ED25519_CERT:
case KEY_ED25519_SK_CERT:
825#ifdef WITH_XMSS
case KEY_XMSS_CERT:
827#endif /* WITH_XMSS */
/* Use the existing blob */
/* XXX modified flag? */
if ((ret = sshbuf_putb(b, key->cert->certblob)) != 0)
	return ret;
break;
833#ifdef WITH_OPENSSL1
case KEY_DSA:
if (key->dsa == NULL((void*)0))
	return SSH_ERR_INVALID_ARGUMENT-10;
DSA_get0_pqg(key->dsa, &dsa_p, &dsa_q, &dsa_g);
DSA_get0_key(key->dsa, &dsa_pub_key, NULL((void*)0));
if ((ret = sshbuf_put_cstring(b, typename)) != 0 ||
    (ret = sshbuf_put_bignum2(b, dsa_p)) != 0 ||
    (ret = sshbuf_put_bignum2(b, dsa_q)) != 0 ||
    (ret = sshbuf_put_bignum2(b, dsa_g)) != 0 ||
    (ret = sshbuf_put_bignum2(b, dsa_pub_key)) != 0)
	return ret;
break;
case KEY_ECDSA:
case KEY_ECDSA_SK:
if (key->ecdsa == NULL((void*)0))
	return SSH_ERR_INVALID_ARGUMENT-10;
if ((ret = sshbuf_put_cstring(b, typename)) != 0 ||
    (ret = sshbuf_put_cstring(b,
    sshkey_curve_nid_to_name(key->ecdsa_nid))) != 0 ||
    (ret = sshbuf_put_eckey(b, key->ecdsa)) != 0)
	return ret;
if (type == KEY_ECDSA_SK) {
	if ((ret = sshbuf_put_cstring(b,
	    key->sk_application)) != 0)
		return ret;
}
break;
case KEY_RSA:
if (key->rsa == NULL((void*)0))
	return SSH_ERR_INVALID_ARGUMENT-10;
RSA_get0_key(key->rsa, &rsa_n, &rsa_e, NULL((void*)0));
if ((ret = sshbuf_put_cstring(b, typename)) != 0 ||
    (ret = sshbuf_put_bignum2(b, rsa_e)) != 0 ||
    (ret = sshbuf_put_bignum2(b, rsa_n)) != 0)
	return ret;
break;
870#endif /* WITH_OPENSSL */
case KEY_ED25519:
case KEY_ED25519_SK:
if (key->ed25519_pk == NULL((void*)0))
	return SSH_ERR_INVALID_ARGUMENT-10;
if ((ret = sshbuf_put_cstring(b, typename)) != 0 ||
    (ret = sshbuf_put_string(b,
    key->ed25519_pk, ED25519_PK_SZ32U)) != 0)
	return ret;
if (type == KEY_ED25519_SK) {
	if ((ret = sshbuf_put_cstring(b,
	    key->sk_application)) != 0)
		return ret;
}
break;
885#ifdef WITH_XMSS
case KEY_XMSS:
if (key->xmss_name == NULL((void*)0) || key->xmss_pk == NULL((void*)0) ||
    sshkey_xmss_pklen(key) == 0)
	return SSH_ERR_INVALID_ARGUMENT-10;
if ((ret = sshbuf_put_cstring(b, typename)) != 0 ||
    (ret = sshbuf_put_cstring(b, key->xmss_name)) != 0 ||
    (ret = sshbuf_put_string(b,
    key->xmss_pk, sshkey_xmss_pklen(key))) != 0 ||
    (ret = sshkey_xmss_serialize_pk_info(key, b, opts)) != 0)
	return ret;
break;
897#endif /* WITH_XMSS */
default:
return SSH_ERR_KEY_TYPE_UNKNOWN-14;
}
return 0;
902}

904int
905sshkey_putb(const struct sshkey *key, struct sshbuf *b)
906{
return to_blob_buf(key, b, 0, SSHKEY_SERIALIZE_DEFAULT);
908}

910int
911sshkey_puts_opts(const struct sshkey *key, struct sshbuf *b,
  enum sshkey_serialize_rep opts)
913{
struct sshbuf *tmp;
int r;

if ((tmp = sshbuf_new()) == NULL((void*)0))
return SSH_ERR_ALLOC_FAIL-2;
r = to_blob_buf(key, tmp, 0, opts);
if (r == 0)
r = sshbuf_put_stringb(b, tmp);
sshbuf_free(tmp);
return r;
924}

926int
927sshkey_puts(const struct sshkey *key, struct sshbuf *b)
928{
return sshkey_puts_opts(key, b, SSHKEY_SERIALIZE_DEFAULT);
930}

932int
933sshkey_putb_plain(const struct sshkey *key, struct sshbuf *b)
934{
return to_blob_buf(key, b, 1, SSHKEY_SERIALIZE_DEFAULT);
936}

938static int
939to_blob(const struct sshkey *key, u_char **blobp, size_t *lenp, int force_plain,
  enum sshkey_serialize_rep opts)
941{
int ret = SSH_ERR_INTERNAL_ERROR-1;
size_t len;
struct sshbuf *b = NULL((void*)0);

if (lenp != NULL((void*)0))
*lenp = 0;
if (blobp != NULL((void*)0))
*blobp = NULL((void*)0);
if ((b = sshbuf_new()) == NULL((void*)0))
return SSH_ERR_ALLOC_FAIL-2;
if ((ret = to_blob_buf(key, b, force_plain, opts)) != 0)
goto out;
len = sshbuf_len(b);
if (lenp != NULL((void*)0))
*lenp = len;
if (blobp != NULL((void*)0)) {
if ((*blobp = malloc(len)) == NULL((void*)0)) {
	ret = SSH_ERR_ALLOC_FAIL-2;
	goto out;
}
memcpy(*blobp, sshbuf_ptr(b), len);
}
ret = 0;
out:
sshbuf_free(b);
return ret;
968}

970int
971sshkey_to_blob(const struct sshkey *key, u_char **blobp, size_t *lenp)
972{
return to_blob(key, blobp, lenp, 0, SSHKEY_SERIALIZE_DEFAULT);
974}

976int
977sshkey_plain_to_blob(const struct sshkey *key, u_char **blobp, size_t *lenp)
978{
return to_blob(key, blobp, lenp, 1, SSHKEY_SERIALIZE_DEFAULT);
980}

982int
983sshkey_fingerprint_raw(const struct sshkey *k, int dgst_alg,
  u_char **retp, size_t *lenp)
985{
u_char *blob = NULL((void*)0), *ret = NULL((void*)0);
size_t blob_len = 0;
int r = SSH_ERR_INTERNAL_ERROR-1;

if (retp != NULL((void*)0))
*retp = NULL((void*)0);
if (lenp != NULL((void*)0))
*lenp = 0;
if (ssh_digest_bytes(dgst_alg) == 0) {
r = SSH_ERR_INVALID_ARGUMENT-10;
goto out;
}
if ((r = to_blob(k, &blob, &blob_len, 1, SSHKEY_SERIALIZE_DEFAULT))
   != 0)
goto out;
if ((ret = calloc(1, SSH_DIGEST_MAX_LENGTH64)) == NULL((void*)0)) {
r = SSH_ERR_ALLOC_FAIL-2;
goto out;
}
if ((r = ssh_digest_memory(dgst_alg, blob, blob_len,
   ret, SSH_DIGEST_MAX_LENGTH64)) != 0)
goto out;
/* success */
if (retp != NULL((void*)0)) {
*retp = ret;
ret = NULL((void*)0);
}
if (lenp != NULL((void*)0))
*lenp = ssh_digest_bytes(dgst_alg);
r = 0;
out:
free(ret);
if (blob != NULL((void*)0))
freezero(blob, blob_len);
return r;
1021}

1023static char *
1024fingerprint_b64(const char *alg, u_char *dgst_raw, size_t dgst_raw_len)
1025{
char *ret;
size_t plen = strlen(alg) + 1;
size_t rlen = ((dgst_raw_len + 2) / 3) * 4 + plen + 1;

if (dgst_raw_len > 65536 || (ret = calloc(1, rlen)) == NULL((void*)0))
return NULL((void*)0);
strlcpy(ret, alg, rlen);
strlcat(ret, ":", rlen);
if (dgst_raw_len == 0)
return ret;
if (b64_ntop__b64_ntop(dgst_raw, dgst_raw_len, ret + plen, rlen - plen) == -1) {
freezero(ret, rlen);
return NULL((void*)0);
}
/* Trim padding characters from end */
ret[strcspn(ret, "=")] = '\0';
return ret;
1043}

1045static char *
1046fingerprint_hex(const char *alg, u_char *dgst_raw, size_t dgst_raw_len)
1047{
char *retval, hex[5];
size_t i, rlen = dgst_raw_len * 3 + strlen(alg) + 2;

if (dgst_raw_len > 65536 || (retval = calloc(1, rlen)) == NULL((void*)0))
return NULL((void*)0);
strlcpy(retval, alg, rlen);
strlcat(retval, ":", rlen);
for (i = 0; i < dgst_raw_len; i++) {
snprintf(hex, sizeof(hex), "%s%02x",
    i > 0 ? ":" : "", dgst_raw[i]);
strlcat(retval, hex, rlen);
}
return retval;
1061}

1063static char *
1064fingerprint_bubblebabble(u_char *dgst_raw, size_t dgst_raw_len)
1065{
char vowels[] = { 'a', 'e', 'i', 'o', 'u', 'y' };
char consonants[] = { 'b', 'c', 'd', 'f', 'g', 'h', 'k', 'l', 'm',
   'n', 'p', 'r', 's', 't', 'v', 'z', 'x' };
u_int i, j = 0, rounds, seed = 1;
char *retval;

rounds = (dgst_raw_len / 2) + 1;
if ((retval = calloc(rounds, 6)) == NULL((void*)0))
return NULL((void*)0);
retval[j++] = 'x';
for (i = 0; i < rounds; i++) {
u_int idx0, idx1, idx2, idx3, idx4;
if ((i + 1 < rounds) || (dgst_raw_len % 2 != 0)) {
	idx0 = (((((u_int)(dgst_raw[2 * i])) >> 6) & 3) +
	    seed) % 6;
	idx1 = (((u_int)(dgst_raw[2 * i])) >> 2) & 15;
	idx2 = ((((u_int)(dgst_raw[2 * i])) & 3) +
	    (seed / 6)) % 6;
	retval[j++] = vowels[idx0];
	retval[j++] = consonants[idx1];
	retval[j++] = vowels[idx2];
	if ((i + 1) < rounds) {
		idx3 = (((u_int)(dgst_raw[(2 * i) + 1])) >> 4) & 15;
		idx4 = (((u_int)(dgst_raw[(2 * i) + 1]))) & 15;
		retval[j++] = consonants[idx3];
		retval[j++] = '-';
		retval[j++] = consonants[idx4];
		seed = ((seed * 5) +
		    ((((u_int)(dgst_raw[2 * i])) * 7) +
		    ((u_int)(dgst_raw[(2 * i) + 1])))) % 36;
	}
} else {
	idx0 = seed % 6;
	idx1 = 16;
	idx2 = seed / 6;
	retval[j++] = vowels[idx0];
	retval[j++] = consonants[idx1];
	retval[j++] = vowels[idx2];
}
}
retval[j++] = 'x';
retval[j++] = '\0';
return retval;
1109}

1111/*
* Draw an ASCII-Art representing the fingerprint so human brain can
* profit from its built-in pattern recognition ability.
* This technique is called "random art" and can be found in some
* scientific publications like this original paper:
*
* "Hash Visualization: a New Technique to improve Real-World Security",
* Perrig A. and Song D., 1999, International Workshop on Cryptographic
* Techniques and E-Commerce (CrypTEC '99)
* sparrow.ece.cmu.edu/~adrian/projects/validation/validation.pdf
*
* The subject came up in a talk by Dan Kaminsky, too.
*
* If you see the picture is different, the key is different.
* If the picture looks the same, you still know nothing.
*
* The algorithm used here is a worm crawling over a discrete plane,
* leaving a trace (augmenting the field) everywhere it goes.
* Movement is taken from dgst_raw 2bit-wise.  Bumping into walls
* makes the respective movement vector be ignored for this turn.
* Graphs are not unambiguous, because circles in graphs can be
* walked in either direction.
*/

1135/*
* Field sizes for the random art.  Have to be odd, so the starting point
* can be in the exact middle of the picture, and FLDBASE should be >=8 .
* Else pictures would be too dense, and drawing the frame would
* fail, too, because the key type would not fit in anymore.
*/
1141#define	FLDBASE8		8
1142#define	FLDSIZE_Y(8 + 1)	(FLDBASE8 + 1)
1143#define	FLDSIZE_X(8 * 2 + 1)	(FLDBASE8 * 2 + 1)
1144static char *
1145fingerprint_randomart(const char *alg, u_char *dgst_raw, size_t dgst_raw_len,
  const struct sshkey *k)
1147{
/*
* Chars to be used after each other every time the worm
* intersects with itself.  Matter of taste.
*/
char	*augmentation_string = " .o+=*BOX@%&#/^SE";
char	*retval, *p, title[FLDSIZE_X(8 * 2 + 1)], hash[FLDSIZE_X(8 * 2 + 1)];
u_char	 field[FLDSIZE_X(8 * 2 + 1)][FLDSIZE_Y(8 + 1)];
size_t	 i, tlen, hlen;
u_int	 b;
int	 x, y, r;
size_t	 len = strlen(augmentation_string) - 1;

if ((retval = calloc((FLDSIZE_X(8 * 2 + 1) + 3), (FLDSIZE_Y(8 + 1) + 2))) == NULL((void*)0))
return NULL((void*)0);

/* initialize field */
memset(field, 0, FLDSIZE_X(8 * 2 + 1) * FLDSIZE_Y(8 + 1) * sizeof(char));
x = FLDSIZE_X(8 * 2 + 1) / 2;
y = FLDSIZE_Y(8 + 1) / 2;

/* process raw key */
for (i = 0; i < dgst_raw_len; i++) {
int input;
/* each byte conveys four 2-bit move commands */
input = dgst_raw[i];
for (b = 0; b < 4; b++) {
	/* evaluate 2 bit, rest is shifted later */
	x += (input & 0x1) ? 1 : -1;
	y += (input & 0x2) ? 1 : -1;

	/* assure we are still in bounds */
	x = MAXIMUM(x, 0)(((x) > (0)) ? (x) : (0));
	y = MAXIMUM(y, 0)(((y) > (0)) ? (y) : (0));
	x = MINIMUM(x, FLDSIZE_X - 1)(((x) < ((8 * 2 + 1) - 1)) ? (x) : ((8 * 2 + 1) - 1));
	y = MINIMUM(y, FLDSIZE_Y - 1)(((y) < ((8 + 1) - 1)) ? (y) : ((8 + 1) - 1));

	/* augment the field */
	if (field[x][y] < len - 2)
		field[x][y]++;
	input = input >> 2;
}
}

/* mark starting point and end point*/
field[FLDSIZE_X(8 * 2 + 1) / 2][FLDSIZE_Y(8 + 1) / 2] = len - 1;
field[x][y] = len;

/* assemble title */
r = snprintf(title, sizeof(title), "[%s %u]",
sshkey_type(k), sshkey_size(k));
/* If [type size] won't fit, then try [type]; fits "[ED25519-CERT]" */
if (r < 0 || r > (int)sizeof(title))
r = snprintf(title, sizeof(title), "[%s]", sshkey_type(k));
tlen = (r <= 0) ? 0 : strlen(title);

/* assemble hash ID. */
r = snprintf(hash, sizeof(hash), "[%s]", alg);
hlen = (r <= 0) ? 0 : strlen(hash);

/* output upper border */
p = retval;
*p++ = '+';
for (i = 0; i < (FLDSIZE_X(8 * 2 + 1) - tlen) / 2; i++)
*p++ = '-';
memcpy(p, title, tlen);
p += tlen;
for (i += tlen; i < FLDSIZE_X(8 * 2 + 1); i++)
*p++ = '-';
*p++ = '+';
*p++ = '\n';

/* output content */
for (y = 0; y < FLDSIZE_Y(8 + 1); y++) {
*p++ = '|';
for (x = 0; x < FLDSIZE_X(8 * 2 + 1); x++)
	*p++ = augmentation_string[MINIMUM(field[x][y], len)(((field[x][y]) < (len)) ? (field[x][y]) : (len))];
*p++ = '|';
*p++ = '\n';
}

/* output lower border */
*p++ = '+';
for (i = 0; i < (FLDSIZE_X(8 * 2 + 1) - hlen) / 2; i++)
*p++ = '-';
memcpy(p, hash, hlen);
p += hlen;
for (i += hlen; i < FLDSIZE_X(8 * 2 + 1); i++)
*p++ = '-';
*p++ = '+';

return retval;
1239}

1241char *
1242sshkey_fingerprint(const struct sshkey *k, int dgst_alg,
  enum sshkey_fp_rep dgst_rep)
1244{
char *retval = NULL((void*)0);
u_char *dgst_raw;
size_t dgst_raw_len;

if (sshkey_fingerprint_raw(k, dgst_alg, &dgst_raw, &dgst_raw_len) != 0)
return NULL((void*)0);
switch (dgst_rep) {
case SSH_FP_DEFAULT:
if (dgst_alg == SSH_DIGEST_MD50) {
	retval = fingerprint_hex(ssh_digest_alg_name(dgst_alg),
	    dgst_raw, dgst_raw_len);
} else {
	retval = fingerprint_b64(ssh_digest_alg_name(dgst_alg),
	    dgst_raw, dgst_raw_len);
}
break;
case SSH_FP_HEX:
retval = fingerprint_hex(ssh_digest_alg_name(dgst_alg),
    dgst_raw, dgst_raw_len);
break;
case SSH_FP_BASE64:
retval = fingerprint_b64(ssh_digest_alg_name(dgst_alg),
    dgst_raw, dgst_raw_len);
break;
case SSH_FP_BUBBLEBABBLE:
retval = fingerprint_bubblebabble(dgst_raw, dgst_raw_len);
break;
case SSH_FP_RANDOMART:
retval = fingerprint_randomart(ssh_digest_alg_name(dgst_alg),
    dgst_raw, dgst_raw_len, k);
break;
default:
freezero(dgst_raw, dgst_raw_len);
return NULL((void*)0);
}
freezero(dgst_raw, dgst_raw_len);
return retval;
1282}

1284static int
1285peek_type_nid(const char *s, size_t l, int *nid)
1286{
const struct keytype *kt;

for (kt = keytypes; kt->type != -1; kt++) {
if (kt->name == NULL((void*)0) || strlen(kt->name) != l)
	continue;
if (memcmp(s, kt->name, l) == 0) {
	*nid = -1;
	if (key_type_is_ecdsa_variant(kt->type))
		*nid = kt->nid;
	return kt->type;
}
}
return KEY_UNSPEC;
1300}

1302/* XXX this can now be made const char * */
1303int
1304sshkey_read(struct sshkey *ret, char **cpp)
1305{
struct sshkey *k;
char *cp, *blobcopy;
size_t space;
int r, type, curve_nid = -1;
struct sshbuf *blob;

if (ret == NULL((void*)0))
return SSH_ERR_INVALID_ARGUMENT-10;

switch (ret->type) {
case KEY_UNSPEC:
case KEY_RSA:
case KEY_DSA:
case KEY_ECDSA:
case KEY_ECDSA_SK:
case KEY_ED25519:
case KEY_ED25519_SK:
case KEY_DSA_CERT:
case KEY_ECDSA_CERT:
case KEY_ECDSA_SK_CERT:
case KEY_RSA_CERT:
case KEY_ED25519_CERT:
case KEY_ED25519_SK_CERT:
1329#ifdef WITH_XMSS
case KEY_XMSS:
case KEY_XMSS_CERT:
1332#endif /* WITH_XMSS */
break; /* ok */
default:
return SSH_ERR_INVALID_ARGUMENT-10;
}

/* Decode type */
cp = *cpp;
space = strcspn(cp, " \t");
if (space == strlen(cp))
return SSH_ERR_INVALID_FORMAT-4;
if ((type = peek_type_nid(cp, space, &curve_nid)) == KEY_UNSPEC)
return SSH_ERR_INVALID_FORMAT-4;

/* skip whitespace */
for (cp += space; *cp == ' ' || *cp == '\t'; cp++)
;
if (*cp == '\0')
return SSH_ERR_INVALID_FORMAT-4;
if (ret->type != KEY_UNSPEC && ret->type != type)
return SSH_ERR_KEY_TYPE_MISMATCH-13;
if ((blob = sshbuf_new()) == NULL((void*)0))
return SSH_ERR_ALLOC_FAIL-2;

/* find end of keyblob and decode */
space = strcspn(cp, " \t");
if ((blobcopy = strndup(cp, space)) == NULL((void*)0)) {
sshbuf_free(blob);
return SSH_ERR_ALLOC_FAIL-2;
}
if ((r = sshbuf_b64tod(blob, blobcopy)) != 0) {
free(blobcopy);
sshbuf_free(blob);
return r;
}
free(blobcopy);
if ((r = sshkey_fromb(blob, &k)) != 0) {
sshbuf_free(blob);
return r;
}
sshbuf_free(blob);

/* skip whitespace and leave cp at start of comment */
for (cp += space; *cp == ' ' || *cp == '\t'; cp++)
;

/* ensure type of blob matches type at start of line */
if (k->type != type) {
sshkey_free(k);
return SSH_ERR_KEY_TYPE_MISMATCH-13;
}
if (key_type_is_ecdsa_variant(type) && curve_nid != k->ecdsa_nid) {
sshkey_free(k);
return SSH_ERR_EC_CURVE_MISMATCH-15;
}

/* Fill in ret from parsed key */
ret->type = type;
if (sshkey_is_cert(ret)) {
if (!sshkey_is_cert(k)) {
	sshkey_free(k);
	return SSH_ERR_EXPECTED_CERT-16;
}
if (ret->cert != NULL((void*)0))
	cert_free(ret->cert);
ret->cert = k->cert;
k->cert = NULL((void*)0);
}
switch (sshkey_type_plain(ret->type)) {
1401#ifdef WITH_OPENSSL1
case KEY_RSA:
RSA_free(ret->rsa);
ret->rsa = k->rsa;
k->rsa = NULL((void*)0);
1406#ifdef DEBUG_PK
RSA_print_fp(stderr(&__sF[2]), ret->rsa, 8);
1408#endif
break;
case KEY_DSA:
DSA_free(ret->dsa);
ret->dsa = k->dsa;
k->dsa = NULL((void*)0);
1414#ifdef DEBUG_PK
DSA_print_fp(stderr(&__sF[2]), ret->dsa, 8);
1416#endif
break;
case KEY_ECDSA:
EC_KEY_free(ret->ecdsa);
ret->ecdsa = k->ecdsa;
ret->ecdsa_nid = k->ecdsa_nid;
k->ecdsa = NULL((void*)0);
k->ecdsa_nid = -1;
1424#ifdef DEBUG_PK
sshkey_dump_ec_key(ret->ecdsa);
1426#endif
break;
case KEY_ECDSA_SK:
EC_KEY_free(ret->ecdsa);
ret->ecdsa = k->ecdsa;
ret->ecdsa_nid = k->ecdsa_nid;
ret->sk_application = k->sk_application;
k->ecdsa = NULL((void*)0);
k->ecdsa_nid = -1;
k->sk_application = NULL((void*)0);
1436#ifdef DEBUG_PK
sshkey_dump_ec_key(ret->ecdsa);
fprintf(stderr(&__sF[2]), "App: %s\n", ret->sk_application);
1439#endif
break;
1441#endif /* WITH_OPENSSL */
case KEY_ED25519:
freezero(ret->ed25519_pk, ED25519_PK_SZ32U);
ret->ed25519_pk = k->ed25519_pk;
k->ed25519_pk = NULL((void*)0);
1446#ifdef DEBUG_PK
/* XXX */
1448#endif
break;
case KEY_ED25519_SK:
freezero(ret->ed25519_pk, ED25519_PK_SZ32U);
ret->ed25519_pk = k->ed25519_pk;
ret->sk_application = k->sk_application;
k->ed25519_pk = NULL((void*)0);
k->sk_application = NULL((void*)0);
break;
1457#ifdef WITH_XMSS
case KEY_XMSS:
free(ret->xmss_pk);
ret->xmss_pk = k->xmss_pk;
k->xmss_pk = NULL((void*)0);
free(ret->xmss_state);
ret->xmss_state = k->xmss_state;
k->xmss_state = NULL((void*)0);
free(ret->xmss_name);
ret->xmss_name = k->xmss_name;
k->xmss_name = NULL((void*)0);
free(ret->xmss_filename);
ret->xmss_filename = k->xmss_filename;
k->xmss_filename = NULL((void*)0);
1471#ifdef DEBUG_PK
/* XXX */
1473#endif
break;
1475#endif /* WITH_XMSS */
default:
sshkey_free(k);
return SSH_ERR_INTERNAL_ERROR-1;
}
sshkey_free(k);

/* success */
*cpp = cp;
return 0;
1485}

1487int
1488sshkey_to_base64(const struct sshkey *key, char **b64p)
1489{
int r = SSH_ERR_INTERNAL_ERROR-1;
struct sshbuf *b = NULL((void*)0);
char *uu = NULL((void*)0);

if (b64p != NULL((void*)0))
*b64p = NULL((void*)0);
if ((b = sshbuf_new()) == NULL((void*)0))
return SSH_ERR_ALLOC_FAIL-2;
if ((r = sshkey_putb(key, b)) != 0)
goto out;
if ((uu = sshbuf_dtob64_string(b, 0)) == NULL((void*)0)) {
r = SSH_ERR_ALLOC_FAIL-2;
goto out;
}
/* Success */
if (b64p != NULL((void*)0)) {
*b64p = uu;
uu = NULL((void*)0);
}
r = 0;
out:
sshbuf_free(b);
free(uu);
return r;
1514}

1516int
1517sshkey_format_text(const struct sshkey *key, struct sshbuf *b)
1518{
int r = SSH_ERR_INTERNAL_ERROR-1;
char *uu = NULL((void*)0);

if ((r = sshkey_to_base64(key, &uu)) != 0)
goto out;
if ((r = sshbuf_putf(b, "%s %s",
   sshkey_ssh_name(key), uu)) != 0)
goto out;
r = 0;
out:
free(uu);
return r;
1531}

1533int
1534sshkey_write(const struct sshkey *key, FILE *f)
1535{
struct sshbuf *b = NULL((void*)0);
int r = SSH_ERR_INTERNAL_ERROR-1;

if ((b = sshbuf_new()) == NULL((void*)0))
return SSH_ERR_ALLOC_FAIL-2;
if ((r = sshkey_format_text(key, b)) != 0)
goto out;
if (fwrite(sshbuf_ptr(b), sshbuf_len(b), 1, f) != 1) {
if (feof(f)(!__isthreaded ? (((f)->_flags & 0x0020) != 0) : (feof
)(f)))
	errno(*__errno()) = EPIPE32;
r = SSH_ERR_SYSTEM_ERROR-24;
goto out;
}
/* Success */
r = 0;
out:
sshbuf_free(b);
return r;
1554}

1556const char *
1557sshkey_cert_type(const struct sshkey *k)
1558{
switch (k->cert->type) {
case SSH2_CERT_TYPE_USER1:
return "user";
case SSH2_CERT_TYPE_HOST2:
return "host";
default:
return "unknown";
}
1567}

1569#ifdef WITH_OPENSSL1
1570static int
1571rsa_generate_private_key(u_int bits, RSA **rsap)
1572{
RSA *private = NULL((void*)0);
BIGNUM *f4 = NULL((void*)0);
int ret = SSH_ERR_INTERNAL_ERROR-1;

if (rsap == NULL((void*)0))
return SSH_ERR_INVALID_ARGUMENT-10;
if (bits < SSH_RSA_MINIMUM_MODULUS_SIZE1024 ||
   bits > SSHBUF_MAX_BIGNUM(16384 / 8) * 8)
return SSH_ERR_KEY_LENGTH-56;
*rsap = NULL((void*)0);
if ((private = RSA_new()) == NULL((void*)0) || (f4 = BN_new()) == NULL((void*)0)) {
ret = SSH_ERR_ALLOC_FAIL-2;
goto out;
}
if (!BN_set_word(f4, RSA_F40x10001L) ||
   !RSA_generate_key_ex(private, bits, f4, NULL((void*)0))) {
ret = SSH_ERR_LIBCRYPTO_ERROR-22;
goto out;
}
*rsap = private;
private = NULL((void*)0);
ret = 0;
out:
RSA_free(private);
BN_free(f4);
return ret;
1599}

1601static int
1602dsa_generate_private_key(u_int bits, DSA **dsap)
1603{
DSA *private;
int ret = SSH_ERR_INTERNAL_ERROR-1;

if (dsap == NULL((void*)0))
return SSH_ERR_INVALID_ARGUMENT-10;
if (bits != 1024)
return SSH_ERR_KEY_LENGTH-56;
if ((private = DSA_new()) == NULL((void*)0)) {
ret = SSH_ERR_ALLOC_FAIL-2;
goto out;
}
*dsap = NULL((void*)0);
if (!DSA_generate_parameters_ex(private, bits, NULL((void*)0), 0, NULL((void*)0),
   NULL((void*)0), NULL((void*)0)) || !DSA_generate_key(private)) {
ret = SSH_ERR_LIBCRYPTO_ERROR-22;
goto out;
}
*dsap = private;
private = NULL((void*)0);
ret = 0;
out:
DSA_free(private);
return ret;
1627}

1629int
1630sshkey_ecdsa_key_to_nid(EC_KEY *k)
1631{
EC_GROUP *eg;
int nids[] = {
NID_X9_62_prime256v1415,
NID_secp384r1715,
NID_secp521r1716,
-1
};
int nid;
u_int i;
const EC_GROUP *g = EC_KEY_get0_group(k);

/*
* The group may be stored in a ASN.1 encoded private key in one of two
* ways: as a "named group", which is reconstituted by ASN.1 object ID
* or explicit group parameters encoded into the key blob. Only the
* "named group" case sets the group NID for us, but we can figure
* it out for the other case by comparing against all the groups that
* are supported.
*/
if ((nid = EC_GROUP_get_curve_name(g)) > 0)
return nid;
for (i = 0; nids[i] != -1; i++) {
if ((eg = EC_GROUP_new_by_curve_name(nids[i])) == NULL((void*)0))
	return -1;
if (EC_GROUP_cmp(g, eg, NULL((void*)0)) == 0)
	break;
EC_GROUP_free(eg);
}
if (nids[i] != -1) {
/* Use the group with the NID attached */
EC_GROUP_set_asn1_flag(eg, OPENSSL_EC_NAMED_CURVE0x001);
if (EC_KEY_set_group(k, eg) != 1) {
	EC_GROUP_free(eg);
	return -1;
}
}
return nids[i];
1669}

1671static int
1672ecdsa_generate_private_key(u_int bits, int *nid, EC_KEY **ecdsap)
1673{
EC_KEY *private;
int ret = SSH_ERR_INTERNAL_ERROR-1;

if (nid == NULL((void*)0) || ecdsap == NULL((void*)0))
return SSH_ERR_INVALID_ARGUMENT-10;
if ((*nid = sshkey_ecdsa_bits_to_nid(bits)) == -1)
return SSH_ERR_KEY_LENGTH-56;
*ecdsap = NULL((void*)0);
if ((private = EC_KEY_new_by_curve_name(*nid)) == NULL((void*)0)) {
ret = SSH_ERR_ALLOC_FAIL-2;
goto out;
}
if (EC_KEY_generate_key(private) != 1) {
ret = SSH_ERR_LIBCRYPTO_ERROR-22;
goto out;
}
EC_KEY_set_asn1_flag(private, OPENSSL_EC_NAMED_CURVE0x001);
*ecdsap = private;
private = NULL((void*)0);
ret = 0;
out:
EC_KEY_free(private);
return ret;
1697}
1698#endif /* WITH_OPENSSL */

1700int
1701sshkey_generate(int type, u_int bits, struct sshkey **keyp)
1702{
struct sshkey *k;
int ret = SSH_ERR_INTERNAL_ERROR-1;

if (keyp == NULL((void*)0))
return SSH_ERR_INVALID_ARGUMENT-10;
*keyp = NULL((void*)0);
if ((k = sshkey_new(KEY_UNSPEC)) == NULL((void*)0))
return SSH_ERR_ALLOC_FAIL-2;
switch (type) {
case KEY_ED25519:
if ((k->ed25519_pk = malloc(ED25519_PK_SZ32U)) == NULL((void*)0) ||
    (k->ed25519_sk = malloc(ED25519_SK_SZ64U)) == NULL((void*)0)) {
	ret = SSH_ERR_ALLOC_FAIL-2;
	break;
}
crypto_sign_ed25519_keypair(k->ed25519_pk, k->ed25519_sk);
ret = 0;
break;
1721#ifdef WITH_XMSS
case KEY_XMSS:
ret = sshkey_xmss_generate_private_key(k, bits);
break;
1725#endif /* WITH_XMSS */
1726#ifdef WITH_OPENSSL1
case KEY_DSA:
ret = dsa_generate_private_key(bits, &k->dsa);
break;
case KEY_ECDSA:
ret = ecdsa_generate_private_key(bits, &k->ecdsa_nid,
    &k->ecdsa);
break;
case KEY_RSA:
ret = rsa_generate_private_key(bits, &k->rsa);
break;
1737#endif /* WITH_OPENSSL */
default:
ret = SSH_ERR_INVALID_ARGUMENT-10;
}
if (ret == 0) {
k->type = type;
*keyp = k;
} else
sshkey_free(k);
return ret;
1747}

1749int
1750sshkey_cert_copy(const struct sshkey *from_key, struct sshkey *to_key)
1751{
u_int i;
const struct sshkey_cert *from;
struct sshkey_cert *to;
int r = SSH_ERR_INTERNAL_ERROR-1;

if (to_key == NULL((void*)0) || (from = from_key->cert) == NULL((void*)0))
return SSH_ERR_INVALID_ARGUMENT-10;

if ((to = cert_new()) == NULL((void*)0))
return SSH_ERR_ALLOC_FAIL-2;

if ((r = sshbuf_putb(to->certblob, from->certblob)) != 0 ||
   (r = sshbuf_putb(to->critical, from->critical)) != 0 ||
   (r = sshbuf_putb(to->extensions, from->extensions)) != 0)
goto out;

to->serial = from->serial;
to->type = from->type;
if (from->key_id == NULL((void*)0))
to->key_id = NULL((void*)0);
else if ((to->key_id = strdup(from->key_id)) == NULL((void*)0)) {
r = SSH_ERR_ALLOC_FAIL-2;
goto out;
}
to->valid_after = from->valid_after;
to->valid_before = from->valid_before;
if (from->signature_key == NULL((void*)0))
to->signature_key = NULL((void*)0);
else if ((r = sshkey_from_private(from->signature_key,
   &to->signature_key)) != 0)
goto out;
if (from->signature_type != NULL((void*)0) &&
   (to->signature_type = strdup(from->signature_type)) == NULL((void*)0)) {
r = SSH_ERR_ALLOC_FAIL-2;
goto out;
}
if (from->nprincipals > SSHKEY_CERT_MAX_PRINCIPALS256) {
r = SSH_ERR_INVALID_ARGUMENT-10;
goto out;
}
if (from->nprincipals > 0) {
if ((to->principals = calloc(from->nprincipals,
    sizeof(*to->principals))) == NULL((void*)0)) {
	r = SSH_ERR_ALLOC_FAIL-2;
	goto out;
}
for (i = 0; i < from->nprincipals; i++) {
	to->principals[i] = strdup(from->principals[i]);
	if (to->principals[i] == NULL((void*)0)) {
		to->nprincipals = i;
		r = SSH_ERR_ALLOC_FAIL-2;
		goto out;
	}
}
}
to->nprincipals = from->nprincipals;

/* success */
cert_free(to_key->cert);
to_key->cert = to;
to = NULL((void*)0);
r = 0;
out:
cert_free(to);
return r;
1817}

1819int
1820sshkey_from_private(const struct sshkey *k, struct sshkey **pkp)
1821{
struct sshkey *n = NULL((void*)0);
int r = SSH_ERR_INTERNAL_ERROR-1;
1824#ifdef WITH_OPENSSL1
const BIGNUM *rsa_n, *rsa_e;
BIGNUM *rsa_n_dup = NULL((void*)0), *rsa_e_dup = NULL((void*)0);
const BIGNUM *dsa_p, *dsa_q, *dsa_g, *dsa_pub_key;
BIGNUM *dsa_p_dup = NULL((void*)0), *dsa_q_dup = NULL((void*)0), *dsa_g_dup = NULL((void*)0);
BIGNUM *dsa_pub_key_dup = NULL((void*)0);
1830#endif /* WITH_OPENSSL */

*pkp = NULL((void*)0);
if ((n = sshkey_new(k->type)) == NULL((void*)0)) {
r = SSH_ERR_ALLOC_FAIL-2;
goto out;
}
switch (k->type) {
1838#ifdef WITH_OPENSSL1
case KEY_DSA:
case KEY_DSA_CERT:
DSA_get0_pqg(k->dsa, &dsa_p, &dsa_q, &dsa_g);
DSA_get0_key(k->dsa, &dsa_pub_key, NULL((void*)0));
if ((dsa_p_dup = BN_dup(dsa_p)) == NULL((void*)0) ||
    (dsa_q_dup = BN_dup(dsa_q)) == NULL((void*)0) ||
    (dsa_g_dup = BN_dup(dsa_g)) == NULL((void*)0) ||
    (dsa_pub_key_dup = BN_dup(dsa_pub_key)) == NULL((void*)0)) {
	r = SSH_ERR_ALLOC_FAIL-2;
	goto out;
}
if (!DSA_set0_pqg(n->dsa, dsa_p_dup, dsa_q_dup, dsa_g_dup)) {
	r = SSH_ERR_LIBCRYPTO_ERROR-22;
	goto out;
}
dsa_p_dup = dsa_q_dup = dsa_g_dup = NULL((void*)0); /* transferred */
if (!DSA_set0_key(n->dsa, dsa_pub_key_dup, NULL((void*)0))) {
	r = SSH_ERR_LIBCRYPTO_ERROR-22;
	goto out;
}
dsa_pub_key_dup = NULL((void*)0); /* transferred */

break;
case KEY_ECDSA:
case KEY_ECDSA_CERT:
case KEY_ECDSA_SK:
case KEY_ECDSA_SK_CERT:
n->ecdsa_nid = k->ecdsa_nid;
n->ecdsa = EC_KEY_new_by_curve_name(k->ecdsa_nid);
if (n->ecdsa == NULL((void*)0)) {
	r = SSH_ERR_ALLOC_FAIL-2;
	goto out;
}
if (EC_KEY_set_public_key(n->ecdsa,
    EC_KEY_get0_public_key(k->ecdsa)) != 1) {
	r = SSH_ERR_LIBCRYPTO_ERROR-22;
	goto out;
}
if (k->type != KEY_ECDSA_SK && k->type != KEY_ECDSA_SK_CERT)
	break;
/* Append security-key application string */
if ((n->sk_application = strdup(k->sk_application)) == NULL((void*)0))
	goto out;
break;
case KEY_RSA:
case KEY_RSA_CERT:
RSA_get0_key(k->rsa, &rsa_n, &rsa_e, NULL((void*)0));
if ((rsa_n_dup = BN_dup(rsa_n)) == NULL((void*)0) ||
    (rsa_e_dup = BN_dup(rsa_e)) == NULL((void*)0)) {
	r = SSH_ERR_ALLOC_FAIL-2;
	goto out;
}
if (!RSA_set0_key(n->rsa, rsa_n_dup, rsa_e_dup, NULL((void*)0))) {
	r = SSH_ERR_LIBCRYPTO_ERROR-22;
	goto out;
}
rsa_n_dup = rsa_e_dup = NULL((void*)0); /* transferred */
break;
1897#endif /* WITH_OPENSSL */
case KEY_ED25519:
case KEY_ED25519_CERT:
case KEY_ED25519_SK:
case KEY_ED25519_SK_CERT:
if (k->ed25519_pk != NULL((void*)0)) {
	if ((n->ed25519_pk = malloc(ED25519_PK_SZ32U)) == NULL((void*)0)) {
		r = SSH_ERR_ALLOC_FAIL-2;
		goto out;
	}
	memcpy(n->ed25519_pk, k->ed25519_pk, ED25519_PK_SZ32U);
}
if (k->type != KEY_ED25519_SK &&
    k->type != KEY_ED25519_SK_CERT)
	break;
/* Append security-key application string */
if ((n->sk_application = strdup(k->sk_application)) == NULL((void*)0))
	goto out;
break;
1916#ifdef WITH_XMSS
case KEY_XMSS:
case KEY_XMSS_CERT:
if ((r = sshkey_xmss_init(n, k->xmss_name)) != 0)
	goto out;
if (k->xmss_pk != NULL((void*)0)) {
	u_int32_t left;
	size_t pklen = sshkey_xmss_pklen(k);
	if (pklen == 0 || sshkey_xmss_pklen(n) != pklen) {
		r = SSH_ERR_INTERNAL_ERROR-1;
		goto out;
	}
	if ((n->xmss_pk = malloc(pklen)) == NULL((void*)0)) {
		r = SSH_ERR_ALLOC_FAIL-2;
		goto out;
	}
	memcpy(n->xmss_pk, k->xmss_pk, pklen);
	/* simulate number of signatures left on pubkey */
	left = sshkey_xmss_signatures_left(k);
	if (left)
		sshkey_xmss_enable_maxsign(n, left);
}
break;
1939#endif /* WITH_XMSS */
default:
r = SSH_ERR_KEY_TYPE_UNKNOWN-14;
goto out;
}
if (sshkey_is_cert(k) && (r = sshkey_cert_copy(k, n)) != 0)
goto out;
/* success */
*pkp = n;
n = NULL((void*)0);
r = 0;
out:
sshkey_free(n);
1952#ifdef WITH_OPENSSL1
BN_clear_free(rsa_n_dup);
BN_clear_free(rsa_e_dup);
BN_clear_free(dsa_p_dup);
BN_clear_free(dsa_q_dup);
BN_clear_free(dsa_g_dup);
BN_clear_free(dsa_pub_key_dup);
1959#endif /* WITH_OPENSSL */

return r;
1962}

1964int
1965sshkey_is_shielded(struct sshkey *k)
1966{
return k != NULL((void*)0) && k->shielded_private != NULL((void*)0);
1968}

1970int
1971sshkey_shield_private(struct sshkey *k)
1972{
struct sshbuf *prvbuf = NULL((void*)0);
u_char *prekey = NULL((void*)0), *enc = NULL((void*)0), keyiv[SSH_DIGEST_MAX_LENGTH64];
struct sshcipher_ctx *cctx = NULL((void*)0);
const struct sshcipher *cipher;
size_t i, enclen = 0;
struct sshkey *kswap = NULL((void*)0), tmp;
int r = SSH_ERR_INTERNAL_ERROR-1;

1981#ifdef DEBUG_PK
fprintf(stderr(&__sF[2]), "%s: entering for %s\n", __func__, sshkey_ssh_name(k));
1983#endif
if ((cipher = cipher_by_name(SSHKEY_SHIELD_CIPHER"aes256-ctr")) == NULL((void*)0)) {
r = SSH_ERR_INVALID_ARGUMENT-10;
goto out;
}
if (cipher_keylen(cipher) + cipher_ivlen(cipher) >
   ssh_digest_bytes(SSHKEY_SHIELD_PREKEY_HASH4)) {
r = SSH_ERR_INTERNAL_ERROR-1;
goto out;
}

/* Prepare a random pre-key, and from it an ephemeral key */
if ((prekey = malloc(SSHKEY_SHIELD_PREKEY_LEN(16 * 1024))) == NULL((void*)0)) {
r = SSH_ERR_ALLOC_FAIL-2;
goto out;
}
arc4random_buf(prekey, SSHKEY_SHIELD_PREKEY_LEN(16 * 1024));
if ((r = ssh_digest_memory(SSHKEY_SHIELD_PREKEY_HASH4,
   prekey, SSHKEY_SHIELD_PREKEY_LEN(16 * 1024),
   keyiv, SSH_DIGEST_MAX_LENGTH64)) != 0)
goto out;
2004#ifdef DEBUG_PK
fprintf(stderr(&__sF[2]), "%s: key+iv\n", __func__);
sshbuf_dump_data(keyiv, ssh_digest_bytes(SSHKEY_SHIELD_PREKEY_HASH4),
   stderr(&__sF[2]));
2008#endif
if ((r = cipher_init(&cctx, cipher, keyiv, cipher_keylen(cipher),
   keyiv + cipher_keylen(cipher), cipher_ivlen(cipher), 1)) != 0)
goto out;

/* Serialise and encrypt the private key using the ephemeral key */
if ((prvbuf = sshbuf_new()) == NULL((void*)0)) {
r = SSH_ERR_ALLOC_FAIL-2;
goto out;
}
if (sshkey_is_shielded(k) && (r = sshkey_unshield_private(k)) != 0)
goto out;
if ((r = sshkey_private_serialize_opt(k, prvbuf,
   SSHKEY_SERIALIZE_SHIELD)) != 0)
goto out;
/* pad to cipher blocksize */
i = 0;
while (sshbuf_len(prvbuf) % cipher_blocksize(cipher)) {
if ((r = sshbuf_put_u8(prvbuf, ++i & 0xff)) != 0)
	goto out;
}
2029#ifdef DEBUG_PK
fprintf(stderr(&__sF[2]), "%s: serialised\n", __func__);
sshbuf_dump(prvbuf, stderr(&__sF[2]));
2032#endif
/* encrypt */
enclen = sshbuf_len(prvbuf);
if ((enc = malloc(enclen)) == NULL((void*)0)) {
r = SSH_ERR_ALLOC_FAIL-2;
goto out;
}
if ((r = cipher_crypt(cctx, 0, enc,
   sshbuf_ptr(prvbuf), sshbuf_len(prvbuf), 0, 0)) != 0)
goto out;
2042#ifdef DEBUG_PK
fprintf(stderr(&__sF[2]), "%s: encrypted\n", __func__);
sshbuf_dump_data(enc, enclen, stderr(&__sF[2]));
2045#endif

/* Make a scrubbed, public-only copy of our private key argument */
if ((r = sshkey_from_private(k, &kswap)) != 0)
goto out;

/* Swap the private key out (it will be destroyed below) */
tmp = *kswap;
*kswap = *k;
*k = tmp;

/* Insert the shielded key into our argument */
k->shielded_private = enc;
k->shielded_len = enclen;
k->shield_prekey = prekey;
k->shield_prekey_len = SSHKEY_SHIELD_PREKEY_LEN(16 * 1024);
enc = prekey = NULL((void*)0); /* transferred */
enclen = 0;

/* preserve key fields that are required for correct operation */
k->sk_flags = kswap->sk_flags;

/* success */
r = 0;

out:
/* XXX behaviour on error - invalidate original private key? */
cipher_free(cctx);
explicit_bzero(keyiv, sizeof(keyiv));
explicit_bzero(&tmp, sizeof(tmp));
freezero(enc, enclen);
freezero(prekey, SSHKEY_SHIELD_PREKEY_LEN(16 * 1024));
sshkey_free(kswap);
sshbuf_free(prvbuf);
return r;
2080}

2082int
2083sshkey_unshield_private(struct sshkey *k)
2084{
struct sshbuf *prvbuf = NULL((void*)0);
u_char pad, *cp, keyiv[SSH_DIGEST_MAX_LENGTH64];
struct sshcipher_ctx *cctx = NULL((void*)0);
const struct sshcipher *cipher;
size_t i;
struct sshkey *kswap = NULL((void*)0), tmp;
int r = SSH_ERR_INTERNAL_ERROR-1;

2093#ifdef DEBUG_PK
fprintf(stderr(&__sF[2]), "%s: entering for %s\n", __func__, sshkey_ssh_name(k));
2095#endif
if (!sshkey_is_shielded(k))
return 0; /* nothing to do */

if ((cipher = cipher_by_name(SSHKEY_SHIELD_CIPHER"aes256-ctr")) == NULL((void*)0)) {
r = SSH_ERR_INVALID_ARGUMENT-10;
goto out;
}
if (cipher_keylen(cipher) + cipher_ivlen(cipher) >
   ssh_digest_bytes(SSHKEY_SHIELD_PREKEY_HASH4)) {
r = SSH_ERR_INTERNAL_ERROR-1;
goto out;
}
/* check size of shielded key blob */
if (k->shielded_len < cipher_blocksize(cipher) ||
   (k->shielded_len % cipher_blocksize(cipher)) != 0) {
r = SSH_ERR_INVALID_FORMAT-4;
goto out;
}

/* Calculate the ephemeral key from the prekey */
if ((r = ssh_digest_memory(SSHKEY_SHIELD_PREKEY_HASH4,
   k->shield_prekey, k->shield_prekey_len,
   keyiv, SSH_DIGEST_MAX_LENGTH64)) != 0)
goto out;
if ((r = cipher_init(&cctx, cipher, keyiv, cipher_keylen(cipher),
   keyiv + cipher_keylen(cipher), cipher_ivlen(cipher), 0)) != 0)
goto out;
2123#ifdef DEBUG_PK
fprintf(stderr(&__sF[2]), "%s: key+iv\n", __func__);
sshbuf_dump_data(keyiv, ssh_digest_bytes(SSHKEY_SHIELD_PREKEY_HASH4),
   stderr(&__sF[2]));
2127#endif

/* Decrypt and parse the shielded private key using the ephemeral key */
if ((prvbuf = sshbuf_new()) == NULL((void*)0)) {
r = SSH_ERR_ALLOC_FAIL-2;
goto out;
}
if ((r = sshbuf_reserve(prvbuf, k->shielded_len, &cp)) != 0)
goto out;
/* decrypt */
2137#ifdef DEBUG_PK
fprintf(stderr(&__sF[2]), "%s: encrypted\n", __func__);
sshbuf_dump_data(k->shielded_private, k->shielded_len, stderr(&__sF[2]));
2140#endif
if ((r = cipher_crypt(cctx, 0, cp,
   k->shielded_private, k->shielded_len, 0, 0)) != 0)
goto out;
2144#ifdef DEBUG_PK
fprintf(stderr(&__sF[2]), "%s: serialised\n", __func__);
sshbuf_dump(prvbuf, stderr(&__sF[2]));
2147#endif
/* Parse private key */
if ((r = sshkey_private_deserialize(prvbuf, &kswap)) != 0)
goto out;
/* Check deterministic padding */
i = 0;
while (sshbuf_len(prvbuf)) {
if ((r = sshbuf_get_u8(prvbuf, &pad)) != 0)
	goto out;
if (pad != (++i & 0xff)) {
	r = SSH_ERR_INVALID_FORMAT-4;
	goto out;
}
}

/* Swap the parsed key back into place */
tmp = *kswap;
*kswap = *k;
*k = tmp;

/* success */
r = 0;

out:
cipher_free(cctx);
explicit_bzero(keyiv, sizeof(keyiv));
explicit_bzero(&tmp, sizeof(tmp));
sshkey_free(kswap);
sshbuf_free(prvbuf);
return r;
2177}

2179static int
2180cert_parse(struct sshbuf *b, struct sshkey *key, struct sshbuf *certbuf)
2181{
struct sshbuf *principals = NULL((void*)0), *crit = NULL((void*)0);
struct sshbuf *exts = NULL((void*)0), *ca = NULL((void*)0);
u_char *sig = NULL((void*)0);
size_t signed_len = 0, slen = 0, kidlen = 0;
int ret = SSH_ERR_INTERNAL_ERROR-1;

/* Copy the entire key blob for verification and later serialisation */
if ((ret = sshbuf_putb(key->cert->certblob, certbuf)) != 0)
42
←
Access to field 'certblob' results in a dereference of a null pointer (loaded from field 'cert')
return ret;

/* Parse body of certificate up to signature */
if ((ret = sshbuf_get_u64(b, &key->cert->serial)) != 0 ||
   (ret = sshbuf_get_u32(b, &key->cert->type)) != 0 ||
   (ret = sshbuf_get_cstring(b, &key->cert->key_id, &kidlen)) != 0 ||
   (ret = sshbuf_froms(b, &principals)) != 0 ||
   (ret = sshbuf_get_u64(b, &key->cert->valid_after)) != 0 ||
   (ret = sshbuf_get_u64(b, &key->cert->valid_before)) != 0 ||
   (ret = sshbuf_froms(b, &crit)) != 0 ||
   (ret = sshbuf_froms(b, &exts)) != 0 ||
   (ret = sshbuf_get_string_direct(b, NULL((void*)0), NULL((void*)0))) != 0 ||
   (ret = sshbuf_froms(b, &ca)) != 0) {
/* XXX debug print error for ret */
ret = SSH_ERR_INVALID_FORMAT-4;
goto out;
}

/* Signature is left in the buffer so we can calculate this length */
signed_len = sshbuf_len(key->cert->certblob) - sshbuf_len(b);

if ((ret = sshbuf_get_string(b, &sig, &slen)) != 0) {
ret = SSH_ERR_INVALID_FORMAT-4;
goto out;
}

if (key->cert->type != SSH2_CERT_TYPE_USER1 &&
   key->cert->type != SSH2_CERT_TYPE_HOST2) {
ret = SSH_ERR_KEY_CERT_UNKNOWN_TYPE-18;
goto out;
}

/* Parse principals section */
while (sshbuf_len(principals) > 0) {
char *principal = NULL((void*)0);
char **oprincipals = NULL((void*)0);

if (key->cert->nprincipals >= SSHKEY_CERT_MAX_PRINCIPALS256) {
	ret = SSH_ERR_INVALID_FORMAT-4;
	goto out;
}
if ((ret = sshbuf_get_cstring(principals, &principal,
    NULL((void*)0))) != 0) {
	ret = SSH_ERR_INVALID_FORMAT-4;
	goto out;
}
oprincipals = key->cert->principals;
key->cert->principals = recallocarray(key->cert->principals,
    key->cert->nprincipals, key->cert->nprincipals + 1,
    sizeof(*key->cert->principals));
if (key->cert->principals == NULL((void*)0)) {
	free(principal);
	key->cert->principals = oprincipals;
	ret = SSH_ERR_ALLOC_FAIL-2;
	goto out;
}
key->cert->principals[key->cert->nprincipals++] = principal;
}

/*
* Stash a copies of the critical options and extensions sections
* for later use.
*/
if ((ret = sshbuf_putb(key->cert->critical, crit)) != 0 ||
   (exts != NULL((void*)0) &&
   (ret = sshbuf_putb(key->cert->extensions, exts)) != 0))
goto out;

/*
* Validate critical options and extensions sections format.
*/
while (sshbuf_len(crit) != 0) {
if ((ret = sshbuf_get_string_direct(crit, NULL((void*)0), NULL((void*)0))) != 0 ||
    (ret = sshbuf_get_string_direct(crit, NULL((void*)0), NULL((void*)0))) != 0) {
	sshbuf_reset(key->cert->critical);
	ret = SSH_ERR_INVALID_FORMAT-4;
	goto out;
}
}
while (exts != NULL((void*)0) && sshbuf_len(exts) != 0) {
if ((ret = sshbuf_get_string_direct(exts, NULL((void*)0), NULL((void*)0))) != 0 ||
    (ret = sshbuf_get_string_direct(exts, NULL((void*)0), NULL((void*)0))) != 0) {
	sshbuf_reset(key->cert->extensions);
	ret = SSH_ERR_INVALID_FORMAT-4;
	goto out;
}
}

/* Parse CA key and check signature */
if (sshkey_from_blob_internal(ca, &key->cert->signature_key, 0) != 0) {
ret = SSH_ERR_KEY_CERT_INVALID_SIGN_KEY-19;
goto out;
}
if (!sshkey_type_is_valid_ca(key->cert->signature_key->type)) {
ret = SSH_ERR_KEY_CERT_INVALID_SIGN_KEY-19;
goto out;
}
if ((ret = sshkey_verify(key->cert->signature_key, sig, slen,
   sshbuf_ptr(key->cert->certblob), signed_len, NULL((void*)0), 0, NULL((void*)0))) != 0)
goto out;
if ((ret = sshkey_get_sigtype(sig, slen,
   &key->cert->signature_type)) != 0)
goto out;

/* Success */
ret = 0;
out:
sshbuf_free(ca);
sshbuf_free(crit);
sshbuf_free(exts);
sshbuf_free(principals);
free(sig);
return ret;
2303}

2305#ifdef WITH_OPENSSL1
2306static int
2307check_rsa_length(const RSA *rsa)
2308{
const BIGNUM *rsa_n;

RSA_get0_key(rsa, &rsa_n, NULL((void*)0), NULL((void*)0));
if (BN_num_bits(rsa_n) < SSH_RSA_MINIMUM_MODULUS_SIZE1024)
return SSH_ERR_KEY_LENGTH-56;
return 0;
2315}
2316#endif /* WITH_OPENSSL */

2318static int
2319sshkey_from_blob_internal(struct sshbuf *b, struct sshkey **keyp,
  int allow_cert)
2321{
int type, ret = SSH_ERR_INTERNAL_ERROR-1;
char *ktype = NULL((void*)0), *curve = NULL((void*)0), *xmss_name = NULL((void*)0);
struct sshkey *key = NULL((void*)0);
size_t len;
u_char *pk = NULL((void*)0);
struct sshbuf *copy;
2328#ifdef WITH_OPENSSL1
EC_POINT *q = NULL((void*)0);
BIGNUM *rsa_n = NULL((void*)0), *rsa_e = NULL((void*)0);
BIGNUM *dsa_p = NULL((void*)0), *dsa_q = NULL((void*)0), *dsa_g = NULL((void*)0), *dsa_pub_key = NULL((void*)0);
2332#endif /* WITH_OPENSSL */

2334#ifdef DEBUG_PK /* XXX */
sshbuf_dump(b, stderr(&__sF[2]));
2336#endif
if (keyp17.1
'keyp' is not equal to NULL
 != NULL((void*)0))
18
←
Taking true branch→
*keyp = NULL((void*)0);
if ((copy = sshbuf_fromb(b)) == NULL((void*)0)) {
19
←
Assuming the condition is false→
20
←
Taking false branch→
ret = SSH_ERR_ALLOC_FAIL-2;
goto out;
}
if (sshbuf_get_cstring(b, &ktype, NULL((void*)0)) != 0) {
21
←
Assuming the condition is false→
22
←
Taking false branch→
ret = SSH_ERR_INVALID_FORMAT-4;
goto out;
}

type = sshkey_type_from_name(ktype);
if (!allow_cert22.1
'allow_cert' is 1
 && sshkey_type_is_cert(type)) {
ret = SSH_ERR_KEY_CERT_INVALID_SIGN_KEY-19;
goto out;
}
switch (type) {
23
←
Control jumps to 'case KEY_ED25519:'  at line 2487→
2354#ifdef WITH_OPENSSL1
case KEY_RSA_CERT:
/* Skip nonce */
if (sshbuf_get_string_direct(b, NULL((void*)0), NULL((void*)0)) != 0) {
	ret = SSH_ERR_INVALID_FORMAT-4;
	goto out;
}
/* FALLTHROUGH */
case KEY_RSA:
if ((key = sshkey_new(type)) == NULL((void*)0)) {
	ret = SSH_ERR_ALLOC_FAIL-2;
	goto out;
}
if (sshbuf_get_bignum2(b, &rsa_e) != 0 ||
    sshbuf_get_bignum2(b, &rsa_n) != 0) {
	ret = SSH_ERR_INVALID_FORMAT-4;
	goto out;
}
if (!RSA_set0_key(key->rsa, rsa_n, rsa_e, NULL((void*)0))) {
	ret = SSH_ERR_LIBCRYPTO_ERROR-22;
	goto out;
}
rsa_n = rsa_e = NULL((void*)0); /* transferred */
if ((ret = check_rsa_length(key->rsa)) != 0)
	goto out;
2379#ifdef DEBUG_PK
RSA_print_fp(stderr(&__sF[2]), key->rsa, 8);
2381#endif
break;
case KEY_DSA_CERT:
/* Skip nonce */
if (sshbuf_get_string_direct(b, NULL((void*)0), NULL((void*)0)) != 0) {
	ret = SSH_ERR_INVALID_FORMAT-4;
	goto out;
}
/* FALLTHROUGH */
case KEY_DSA:
if ((key = sshkey_new(type)) == NULL((void*)0)) {
	ret = SSH_ERR_ALLOC_FAIL-2;
	goto out;
}
if (sshbuf_get_bignum2(b, &dsa_p) != 0 ||
    sshbuf_get_bignum2(b, &dsa_q) != 0 ||
    sshbuf_get_bignum2(b, &dsa_g) != 0 ||
    sshbuf_get_bignum2(b, &dsa_pub_key) != 0) {
	ret = SSH_ERR_INVALID_FORMAT-4;
	goto out;
}
if (!DSA_set0_pqg(key->dsa, dsa_p, dsa_q, dsa_g)) {
	ret = SSH_ERR_LIBCRYPTO_ERROR-22;
	goto out;
}
dsa_p = dsa_q = dsa_g = NULL((void*)0); /* transferred */
if (!DSA_set0_key(key->dsa, dsa_pub_key, NULL((void*)0))) {
	ret = SSH_ERR_LIBCRYPTO_ERROR-22;
	goto out;
}
dsa_pub_key = NULL((void*)0); /* transferred */
2412#ifdef DEBUG_PK
DSA_print_fp(stderr(&__sF[2]), key->dsa, 8);
2414#endif
break;
case KEY_ECDSA_CERT:
case KEY_ECDSA_SK_CERT:
/* Skip nonce */
if (sshbuf_get_string_direct(b, NULL((void*)0), NULL((void*)0)) != 0) {
	ret = SSH_ERR_INVALID_FORMAT-4;
	goto out;
}
/* FALLTHROUGH */
case KEY_ECDSA:
case KEY_ECDSA_SK:
if ((key = sshkey_new(type)) == NULL((void*)0)) {
	ret = SSH_ERR_ALLOC_FAIL-2;
	goto out;
}
key->ecdsa_nid = sshkey_ecdsa_nid_from_name(ktype);
if (sshbuf_get_cstring(b, &curve, NULL((void*)0)) != 0) {
	ret = SSH_ERR_INVALID_FORMAT-4;
	goto out;
}
if (key->ecdsa_nid != sshkey_curve_name_to_nid(curve)) {
	ret = SSH_ERR_EC_CURVE_MISMATCH-15;
	goto out;
}
EC_KEY_free(key->ecdsa);
if ((key->ecdsa = EC_KEY_new_by_curve_name(key->ecdsa_nid))
    == NULL((void*)0)) {
	ret = SSH_ERR_EC_CURVE_INVALID-12;
	goto out;
}
if ((q = EC_POINT_new(EC_KEY_get0_group(key->ecdsa))) == NULL((void*)0)) {
	ret = SSH_ERR_ALLOC_FAIL-2;
	goto out;
}
if (sshbuf_get_ec(b, q, EC_KEY_get0_group(key->ecdsa)) != 0) {
	ret = SSH_ERR_INVALID_FORMAT-4;
	goto out;
}
if (sshkey_ec_validate_public(EC_KEY_get0_group(key->ecdsa),
    q) != 0) {
	ret = SSH_ERR_KEY_INVALID_EC_VALUE-20;
	goto out;
}
if (EC_KEY_set_public_key(key->ecdsa, q) != 1) {
	/* XXX assume it is a allocation error */
	ret = SSH_ERR_ALLOC_FAIL-2;
	goto out;
}
2463#ifdef DEBUG_PK
sshkey_dump_ec_point(EC_KEY_get0_group(key->ecdsa), q);
2465#endif
if (type == KEY_ECDSA_SK || type == KEY_ECDSA_SK_CERT) {
	/* Parse additional security-key application string */
	if (sshbuf_get_cstring(b, &key->sk_application,
	    NULL((void*)0)) != 0) {
		ret = SSH_ERR_INVALID_FORMAT-4;
		goto out;
	}
2473#ifdef DEBUG_PK
	fprintf(stderr(&__sF[2]), "App: %s\n", key->sk_application);
2475#endif
}
break;
2478#endif /* WITH_OPENSSL */
case KEY_ED25519_CERT:
case KEY_ED25519_SK_CERT:
/* Skip nonce */
if (sshbuf_get_string_direct(b, NULL((void*)0), NULL((void*)0)) != 0) {
	ret = SSH_ERR_INVALID_FORMAT-4;
	goto out;
}
/* FALLTHROUGH */
case KEY_ED25519:
case KEY_ED25519_SK:
if ((ret = sshbuf_get_string(b, &pk, &len)) != 0)
24
←
Assuming the condition is false→
25
←
Taking false branch→
	goto out;
if (len != ED25519_PK_SZ32U) {
26
←
Assuming 'len' is equal to ED25519_PK_SZ→
27
←
Taking false branch→
	ret = SSH_ERR_INVALID_FORMAT-4;
	goto out;
}
if ((key = sshkey_new(type)) == NULL((void*)0)) {
28
←
Calling 'sshkey_new'→
36
←
Returning from 'sshkey_new'→
37
←
Taking false branch→
	ret = SSH_ERR_ALLOC_FAIL-2;
	goto out;
}
if (type37.1
'type' is not equal to KEY_ED25519_SK
 == KEY_ED25519_SK || type37.2
'type' is not equal to KEY_ED25519_SK_CERT
 == KEY_ED25519_SK_CERT) {
38
←
Taking false branch→
	/* Parse additional security-key application string */
	if (sshbuf_get_cstring(b, &key->sk_application,
	    NULL((void*)0)) != 0) {
		ret = SSH_ERR_INVALID_FORMAT-4;
		goto out;
	}
2506#ifdef DEBUG_PK
	fprintf(stderr(&__sF[2]), "App: %s\n", key->sk_application);
2508#endif
}
key->ed25519_pk = pk;
pk = NULL((void*)0);
break;
39
←
 Execution continues on line 2550→
2513#ifdef WITH_XMSS
case KEY_XMSS_CERT:
/* Skip nonce */
if (sshbuf_get_string_direct(b, NULL((void*)0), NULL((void*)0)) != 0) {
	ret = SSH_ERR_INVALID_FORMAT-4;
	goto out;
}
/* FALLTHROUGH */
case KEY_XMSS:
if ((ret = sshbuf_get_cstring(b, &xmss_name, NULL((void*)0))) != 0)
	goto out;
if ((key = sshkey_new(type)) == NULL((void*)0)) {
	ret = SSH_ERR_ALLOC_FAIL-2;
	goto out;
}
if ((ret = sshkey_xmss_init(key, xmss_name)) != 0)
	goto out;
if ((ret = sshbuf_get_string(b, &pk, &len)) != 0)
	goto out;
if (len == 0 || len != sshkey_xmss_pklen(key)) {
	ret = SSH_ERR_INVALID_FORMAT-4;
	goto out;
}
key->xmss_pk = pk;
pk = NULL((void*)0);
if (type != KEY_XMSS_CERT &&
    (ret = sshkey_xmss_deserialize_pk_info(key, b)) != 0)
	goto out;
break;
2542#endif /* WITH_XMSS */
case KEY_UNSPEC:
default:
ret = SSH_ERR_KEY_TYPE_UNKNOWN-14;
goto out;
}

/* Parse certificate potion */
if (sshkey_is_cert(key) && (ret = cert_parse(b, key, copy)) != 0)
40
←
Assuming the condition is true→
41
←
Calling 'cert_parse'→
goto out;

if (key != NULL((void*)0) && sshbuf_len(b) != 0) {
ret = SSH_ERR_INVALID_FORMAT-4;
goto out;
}
ret = 0;
if (keyp != NULL((void*)0)) {
*keyp = key;
key = NULL((void*)0);
}
out:
sshbuf_free(copy);
sshkey_free(key);
free(xmss_name);
free(ktype);
free(curve);
free(pk);
2569#ifdef WITH_OPENSSL1
EC_POINT_free(q);
BN_clear_free(rsa_n);
BN_clear_free(rsa_e);
BN_clear_free(dsa_p);
BN_clear_free(dsa_q);
BN_clear_free(dsa_g);
BN_clear_free(dsa_pub_key);
2577#endif /* WITH_OPENSSL */
return ret;
2579}

2581int
2582sshkey_from_blob(const u_char *blob, size_t blen, struct sshkey **keyp)
2583{
struct sshbuf *b;
int r;

if ((b = sshbuf_from(blob, blen)) == NULL((void*)0))
return SSH_ERR_ALLOC_FAIL-2;
r = sshkey_from_blob_internal(b, keyp, 1);
sshbuf_free(b);
return r;
2592}

2594int
2595sshkey_fromb(struct sshbuf *b, struct sshkey **keyp)
2596{
return sshkey_from_blob_internal(b, keyp, 1);
2598}

2600int
2601sshkey_froms(struct sshbuf *buf, struct sshkey **keyp)
2602{
struct sshbuf *b;
int r;

if ((r = sshbuf_froms(buf, &b)) != 0)
15
←
Assuming the condition is false→
16
←
Taking false branch→
return r;
r = sshkey_from_blob_internal(b, keyp, 1);
17
←
Calling 'sshkey_from_blob_internal'→
sshbuf_free(b);
return r;
2611}

2613int
2614sshkey_get_sigtype(const u_char *sig, size_t siglen, char **sigtypep)
2615{
int r;
struct sshbuf *b = NULL((void*)0);
char *sigtype = NULL((void*)0);

if (sigtypep != NULL((void*)0))
*sigtypep = NULL((void*)0);
if ((b = sshbuf_from(sig, siglen)) == NULL((void*)0))
return SSH_ERR_ALLOC_FAIL-2;
if ((r = sshbuf_get_cstring(b, &sigtype, NULL((void*)0))) != 0)
goto out;
/* success */
if (sigtypep != NULL((void*)0)) {
*sigtypep = sigtype;
sigtype = NULL((void*)0);
}
r = 0;
out:
free(sigtype);
sshbuf_free(b);
return r;
2636}

2638/*
*
* Checks whether a certificate's signature type is allowed.
* Returns 0 (success) if the certificate signature type appears in the
* "allowed" pattern-list, or the key is not a certificate to begin with.
* Otherwise returns a ssherr.h code.
*/
2645int
2646sshkey_check_cert_sigtype(const struct sshkey *key, const char *allowed)
2647{
if (key == NULL((void*)0) || allowed == NULL((void*)0))
return SSH_ERR_INVALID_ARGUMENT-10;
if (!sshkey_type_is_cert(key->type))
return 0;
if (key->cert == NULL((void*)0) || key->cert->signature_type == NULL((void*)0))
return SSH_ERR_INVALID_ARGUMENT-10;
if (match_pattern_list(key->cert->signature_type, allowed, 0) != 1)
return SSH_ERR_SIGN_ALG_UNSUPPORTED-58;
return 0;
2657}

2659/*
* Returns the expected signature algorithm for a given public key algorithm.
*/
2662const char *
2663sshkey_sigalg_by_name(const char *name)
2664{
const struct keytype *kt;

for (kt = keytypes; kt->type != -1; kt++) {
if (strcmp(kt->name, name) != 0)
	continue;
if (kt->sigalg != NULL((void*)0))
	return kt->sigalg;
if (!kt->cert)
	return kt->name;
return sshkey_ssh_name_from_type_nid(
    sshkey_type_plain(kt->type), kt->nid);
}
return NULL((void*)0);
2678}

2680/*
* Verifies that the signature algorithm appearing inside the signature blob
* matches that which was requested.
*/
2684int
2685sshkey_check_sigtype(const u_char *sig, size_t siglen,
  const char *requested_alg)
2687{
const char *expected_alg;
char *sigtype = NULL((void*)0);
int r;

if (requested_alg == NULL((void*)0))
return 0;
if ((expected_alg = sshkey_sigalg_by_name(requested_alg)) == NULL((void*)0))
return SSH_ERR_INVALID_ARGUMENT-10;
if ((r = sshkey_get_sigtype(sig, siglen, &sigtype)) != 0)
return r;
r = strcmp(expected_alg, sigtype) == 0;
free(sigtype);
return r ? 0 : SSH_ERR_SIGN_ALG_UNSUPPORTED-58;
2701}

2703int
2704sshkey_sign(struct sshkey *key,
  u_char **sigp, size_t *lenp,
  const u_char *data, size_t datalen,
  const char *alg, const char *sk_provider, const char *sk_pin, u_int compat)
2708{
int was_shielded = sshkey_is_shielded(key);
int r2, r = SSH_ERR_INTERNAL_ERROR-1;

if (sigp != NULL((void*)0))
*sigp = NULL((void*)0);
if (lenp != NULL((void*)0))
*lenp = 0;
if (datalen > SSH_KEY_MAX_SIGN_DATA_SIZE(1 << 20))
return SSH_ERR_INVALID_ARGUMENT-10;
if ((r = sshkey_unshield_private(key)) != 0)
return r;
switch (key->type) {
2721#ifdef WITH_OPENSSL1
case KEY_DSA_CERT:
case KEY_DSA:
r = ssh_dss_sign(key, sigp, lenp, data, datalen, compat);
break;
case KEY_ECDSA_CERT:
case KEY_ECDSA:
r = ssh_ecdsa_sign(key, sigp, lenp, data, datalen, compat);
break;
case KEY_RSA_CERT:
case KEY_RSA:
r = ssh_rsa_sign(key, sigp, lenp, data, datalen, alg);
break;
2734#endif /* WITH_OPENSSL */
case KEY_ED25519:
case KEY_ED25519_CERT:
r = ssh_ed25519_sign(key, sigp, lenp, data, datalen, compat);
break;
case KEY_ED25519_SK:
case KEY_ED25519_SK_CERT:
case KEY_ECDSA_SK_CERT:
case KEY_ECDSA_SK:
r = sshsk_sign(sk_provider, key, sigp, lenp, data,
    datalen, compat, sk_pin);
break;
2746#ifdef WITH_XMSS
case KEY_XMSS:
case KEY_XMSS_CERT:
r = ssh_xmss_sign(key, sigp, lenp, data, datalen, compat);
break;
2751#endif /* WITH_XMSS */
default:
r = SSH_ERR_KEY_TYPE_UNKNOWN-14;
break;
}
if (was_shielded && (r2 = sshkey_shield_private(key)) != 0)
return r2;
return r;
2759}

2761/*
* ssh_key_verify returns 0 for a correct signature  and < 0 on error.
* If "alg" specified, then the signature must use that algorithm.
*/
2765int
2766sshkey_verify(const struct sshkey *key,
  const u_char *sig, size_t siglen,
  const u_char *data, size_t dlen, const char *alg, u_int compat,
  struct sshkey_sig_details **detailsp)
2770{
if (detailsp != NULL((void*)0))
*detailsp = NULL((void*)0);
if (siglen == 0 || dlen > SSH_KEY_MAX_SIGN_DATA_SIZE(1 << 20))
return SSH_ERR_INVALID_ARGUMENT-10;
switch (key->type) {
2776#ifdef WITH_OPENSSL1
case KEY_DSA_CERT:
case KEY_DSA:
return ssh_dss_verify(key, sig, siglen, data, dlen, compat);
case KEY_ECDSA_CERT:
case KEY_ECDSA:
return ssh_ecdsa_verify(key, sig, siglen, data, dlen, compat);
case KEY_ECDSA_SK_CERT:
case KEY_ECDSA_SK:
return ssh_ecdsa_sk_verify(key, sig, siglen, data, dlen,
    compat, detailsp);
case KEY_RSA_CERT:
case KEY_RSA:
return ssh_rsa_verify(key, sig, siglen, data, dlen, alg);
2790#endif /* WITH_OPENSSL */
case KEY_ED25519:
case KEY_ED25519_CERT:
return ssh_ed25519_verify(key, sig, siglen, data, dlen, compat);
case KEY_ED25519_SK:
case KEY_ED25519_SK_CERT:
return ssh_ed25519_sk_verify(key, sig, siglen, data, dlen,
    compat, detailsp);
2798#ifdef WITH_XMSS
case KEY_XMSS:
case KEY_XMSS_CERT:
return ssh_xmss_verify(key, sig, siglen, data, dlen, compat);
2802#endif /* WITH_XMSS */
default:
return SSH_ERR_KEY_TYPE_UNKNOWN-14;
}
2806}

2808/* Convert a plain key to their _CERT equivalent */
2809int
2810sshkey_to_certified(struct sshkey *k)
2811{
int newtype;

switch (k->type) {
2815#ifdef WITH_OPENSSL1
case KEY_RSA:
newtype = KEY_RSA_CERT;
break;
case KEY_DSA:
newtype = KEY_DSA_CERT;
break;
case KEY_ECDSA:
newtype = KEY_ECDSA_CERT;
break;
case KEY_ECDSA_SK:
newtype = KEY_ECDSA_SK_CERT;
break;
2828#endif /* WITH_OPENSSL */
case KEY_ED25519_SK:
newtype = KEY_ED25519_SK_CERT;
break;
case KEY_ED25519:
newtype = KEY_ED25519_CERT;
break;
2835#ifdef WITH_XMSS
case KEY_XMSS:
newtype = KEY_XMSS_CERT;
break;
2839#endif /* WITH_XMSS */
default:
return SSH_ERR_INVALID_ARGUMENT-10;
}
if ((k->cert = cert_new()) == NULL((void*)0))
return SSH_ERR_ALLOC_FAIL-2;
k->type = newtype;
return 0;
2847}

2849/* Convert a certificate to its raw key equivalent */
2850int
2851sshkey_drop_cert(struct sshkey *k)
2852{
if (!sshkey_type_is_cert(k->type))
return SSH_ERR_KEY_TYPE_UNKNOWN-14;
cert_free(k->cert);
k->cert = NULL((void*)0);
k->type = sshkey_type_plain(k->type);
return 0;
2859}

2861/* Sign a certified key, (re-)generating the signed certblob. */
2862int
2863sshkey_certify_custom(struct sshkey *k, struct sshkey *ca, const char *alg,
  const char *sk_provider, const char *sk_pin,
  sshkey_certify_signer *signer, void *signer_ctx)
2866{
struct sshbuf *principals = NULL((void*)0);
u_char *ca_blob = NULL((void*)0), *sig_blob = NULL((void*)0), nonce[32];
size_t i, ca_len, sig_len;
int ret = SSH_ERR_INTERNAL_ERROR-1;
struct sshbuf *cert = NULL((void*)0);
char *sigtype = NULL((void*)0);
2873#ifdef WITH_OPENSSL1
const BIGNUM *rsa_n, *rsa_e, *dsa_p, *dsa_q, *dsa_g, *dsa_pub_key;
2875#endif /* WITH_OPENSSL */

if (k == NULL((void*)0) || k->cert == NULL((void*)0) ||
   k->cert->certblob == NULL((void*)0) || ca == NULL((void*)0))
return SSH_ERR_INVALID_ARGUMENT-10;
if (!sshkey_is_cert(k))
return SSH_ERR_KEY_TYPE_UNKNOWN-14;
if (!sshkey_type_is_valid_ca(ca->type))
return SSH_ERR_KEY_CERT_INVALID_SIGN_KEY-19;

/*
* If no alg specified as argument but a signature_type was set,
* then prefer that. If both were specified, then they must match.
*/
if (alg == NULL((void*)0))
alg = k->cert->signature_type;
else if (k->cert->signature_type != NULL((void*)0) &&
   strcmp(alg, k->cert->signature_type) != 0)
return SSH_ERR_INVALID_ARGUMENT-10;

/*
* If no signing algorithm or signature_type was specified and we're
* using a RSA key, then default to a good signature algorithm.
*/
if (alg == NULL((void*)0) && ca->type == KEY_RSA)
alg = "rsa-sha2-512";

if ((ret = sshkey_to_blob(ca, &ca_blob, &ca_len)) != 0)
return SSH_ERR_KEY_CERT_INVALID_SIGN_KEY-19;

cert = k->cert->certblob; /* for readability */
sshbuf_reset(cert);
if ((ret = sshbuf_put_cstring(cert, sshkey_ssh_name(k))) != 0)
goto out;

/* -v01 certs put nonce first */
arc4random_buf(&nonce, sizeof(nonce));
if ((ret = sshbuf_put_string(cert, nonce, sizeof(nonce))) != 0)
goto out;

/* XXX this substantially duplicates to_blob(); refactor */
switch (k->type) {
2917#ifdef WITH_OPENSSL1
case KEY_DSA_CERT:
DSA_get0_pqg(k->dsa, &dsa_p, &dsa_q, &dsa_g);
DSA_get0_key(k->dsa, &dsa_pub_key, NULL((void*)0));
if ((ret = sshbuf_put_bignum2(cert, dsa_p)) != 0 ||
    (ret = sshbuf_put_bignum2(cert, dsa_q)) != 0 ||
    (ret = sshbuf_put_bignum2(cert, dsa_g)) != 0 ||
    (ret = sshbuf_put_bignum2(cert, dsa_pub_key)) != 0)
	goto out;
break;
case KEY_ECDSA_CERT:
case KEY_ECDSA_SK_CERT:
if ((ret = sshbuf_put_cstring(cert,
    sshkey_curve_nid_to_name(k->ecdsa_nid))) != 0 ||
    (ret = sshbuf_put_ec(cert,
    EC_KEY_get0_public_key(k->ecdsa),
    EC_KEY_get0_group(k->ecdsa))) != 0)
	goto out;
if (k->type == KEY_ECDSA_SK_CERT) {
	if ((ret = sshbuf_put_cstring(cert,
	    k->sk_application)) != 0)
		goto out;
}
break;
case KEY_RSA_CERT:
RSA_get0_key(k->rsa, &rsa_n, &rsa_e, NULL((void*)0));
if ((ret = sshbuf_put_bignum2(cert, rsa_e)) != 0 ||
    (ret = sshbuf_put_bignum2(cert, rsa_n)) != 0)
	goto out;
break;
2947#endif /* WITH_OPENSSL */
case KEY_ED25519_CERT:
case KEY_ED25519_SK_CERT:
if ((ret = sshbuf_put_string(cert,
    k->ed25519_pk, ED25519_PK_SZ32U)) != 0)
	goto out;
if (k->type == KEY_ED25519_SK_CERT) {
	if ((ret = sshbuf_put_cstring(cert,
	    k->sk_application)) != 0)
		goto out;
}
break;
2959#ifdef WITH_XMSS
case KEY_XMSS_CERT:
if (k->xmss_name == NULL((void*)0)) {
	ret = SSH_ERR_INVALID_ARGUMENT-10;
	goto out;
}
if ((ret = sshbuf_put_cstring(cert, k->xmss_name)) ||
    (ret = sshbuf_put_string(cert,
    k->xmss_pk, sshkey_xmss_pklen(k))) != 0)
	goto out;
break;
2970#endif /* WITH_XMSS */
default:
ret = SSH_ERR_INVALID_ARGUMENT-10;
goto out;
}

if ((ret = sshbuf_put_u64(cert, k->cert->serial)) != 0 ||
   (ret = sshbuf_put_u32(cert, k->cert->type)) != 0 ||
   (ret = sshbuf_put_cstring(cert, k->cert->key_id)) != 0)
goto out;

if ((principals = sshbuf_new()) == NULL((void*)0)) {
ret = SSH_ERR_ALLOC_FAIL-2;
goto out;
}
for (i = 0; i < k->cert->nprincipals; i++) {
if ((ret = sshbuf_put_cstring(principals,
    k->cert->principals[i])) != 0)
	goto out;
}
if ((ret = sshbuf_put_stringb(cert, principals)) != 0 ||
   (ret = sshbuf_put_u64(cert, k->cert->valid_after)) != 0 ||
   (ret = sshbuf_put_u64(cert, k->cert->valid_before)) != 0 ||
   (ret = sshbuf_put_stringb(cert, k->cert->critical)) != 0 ||
   (ret = sshbuf_put_stringb(cert, k->cert->extensions)) != 0 ||
   (ret = sshbuf_put_string(cert, NULL((void*)0), 0)) != 0 || /* Reserved */
   (ret = sshbuf_put_string(cert, ca_blob, ca_len)) != 0)
goto out;

/* Sign the whole mess */
if ((ret = signer(ca, &sig_blob, &sig_len, sshbuf_ptr(cert),
   sshbuf_len(cert), alg, sk_provider, sk_pin, 0, signer_ctx)) != 0)
goto out;
/* Check and update signature_type against what was actually used */
if ((ret = sshkey_get_sigtype(sig_blob, sig_len, &sigtype)) != 0)
goto out;
if (alg != NULL((void*)0) && strcmp(alg, sigtype) != 0) {
ret = SSH_ERR_SIGN_ALG_UNSUPPORTED-58;
goto out;
}
if (k->cert->signature_type == NULL((void*)0)) {
k->cert->signature_type = sigtype;
sigtype = NULL((void*)0);
}
/* Append signature and we are done */
if ((ret = sshbuf_put_string(cert, sig_blob, sig_len)) != 0)
goto out;
ret = 0;
out:
if (ret != 0)
sshbuf_reset(cert);
free(sig_blob);
free(ca_blob);
free(sigtype);
sshbuf_free(principals);
return ret;
3026}

3028static int
3029default_key_sign(struct sshkey *key, u_char **sigp, size_t *lenp,
  const u_char *data, size_t datalen,
  const char *alg, const char *sk_provider, const char *sk_pin,
  u_int compat, void *ctx)
3033{
if (ctx != NULL((void*)0))
return SSH_ERR_INVALID_ARGUMENT-10;
return sshkey_sign(key, sigp, lenp, data, datalen, alg,
   sk_provider, sk_pin, compat);
3038}

3040int
3041sshkey_certify(struct sshkey *k, struct sshkey *ca, const char *alg,
  const char *sk_provider, const char *sk_pin)
3043{
return sshkey_certify_custom(k, ca, alg, sk_provider, sk_pin,
   default_key_sign, NULL((void*)0));
3046}

3048int
3049sshkey_cert_check_authority(const struct sshkey *k,
  int want_host, int require_principal, int wildcard_pattern,
  uint64_t verify_time, const char *name, const char **reason)
3052{
u_int i, principal_matches;

if (reason == NULL((void*)0))
return SSH_ERR_INVALID_ARGUMENT-10;
if (!sshkey_is_cert(k)) {
*reason = "Key is not a certificate";
return SSH_ERR_KEY_CERT_INVALID-25;
}
if (want_host) {
if (k->cert->type != SSH2_CERT_TYPE_HOST2) {
	*reason = "Certificate invalid: not a host certificate";
	return SSH_ERR_KEY_CERT_INVALID-25;
}
} else {
if (k->cert->type != SSH2_CERT_TYPE_USER1) {
	*reason = "Certificate invalid: not a user certificate";
	return SSH_ERR_KEY_CERT_INVALID-25;
}
}
if (verify_time < k->cert->valid_after) {
*reason = "Certificate invalid: not yet valid";
return SSH_ERR_KEY_CERT_INVALID-25;
}
if (verify_time >= k->cert->valid_before) {
*reason = "Certificate invalid: expired";
return SSH_ERR_KEY_CERT_INVALID-25;
}
if (k->cert->nprincipals == 0) {
if (require_principal) {
	*reason = "Certificate lacks principal list";
	return SSH_ERR_KEY_CERT_INVALID-25;
}
} else if (name != NULL((void*)0)) {
principal_matches = 0;
for (i = 0; i < k->cert->nprincipals; i++) {
	if (wildcard_pattern) {
		if (match_pattern(k->cert->principals[i],
		    name)) {
			principal_matches = 1;
			break;
		}
	} else if (strcmp(name, k->cert->principals[i]) == 0) {
		principal_matches = 1;
		break;
	}
}
if (!principal_matches) {
	*reason = "Certificate invalid: name is not a listed "
	    "principal";
	return SSH_ERR_KEY_CERT_INVALID-25;
}
}
return 0;
3106}

3108int
3109sshkey_cert_check_authority_now(const struct sshkey *k,
  int want_host, int require_principal, int wildcard_pattern,
  const char *name, const char **reason)
3112{
time_t now;

if ((now = time(NULL((void*)0))) < 0) {
/* yikes - system clock before epoch! */
*reason = "Certificate invalid: not yet valid";
return SSH_ERR_KEY_CERT_INVALID-25;
}
return sshkey_cert_check_authority(k, want_host, require_principal,
   wildcard_pattern, (uint64_t)now, name, reason);
3122}

3124int
3125sshkey_cert_check_host(const struct sshkey *key, const char *host,
  int wildcard_principals, const char *ca_sign_algorithms,
  const char **reason)
3128{
int r;

if ((r = sshkey_cert_check_authority_now(key, 1, 0, wildcard_principals,
   host, reason)) != 0)
return r;
if (sshbuf_len(key->cert->critical) != 0) {
*reason = "Certificate contains unsupported critical options";
return SSH_ERR_KEY_CERT_INVALID-25;
}
if (ca_sign_algorithms != NULL((void*)0) &&
   (r = sshkey_check_cert_sigtype(key, ca_sign_algorithms)) != 0) {
*reason = "Certificate signed with disallowed algorithm";
return SSH_ERR_KEY_CERT_INVALID-25;
}
return 0;
3144}

3146size_t
3147sshkey_format_cert_validity(const struct sshkey_cert *cert, char *s, size_t l)
3148{
char from[32], to[32], ret[128];

*from = *to = '\0';
if (cert->valid_after == 0 &&
   cert->valid_before == 0xffffffffffffffffULL)
return strlcpy(s, "forever", l);

if (cert->valid_after != 0)
format_absolute_time(cert->valid_after, from, sizeof(from));
if (cert->valid_before != 0xffffffffffffffffULL)
format_absolute_time(cert->valid_before, to, sizeof(to));

if (cert->valid_after == 0)
snprintf(ret, sizeof(ret), "before %s", to);
else if (cert->valid_before == 0xffffffffffffffffULL)
snprintf(ret, sizeof(ret), "after %s", from);
else
snprintf(ret, sizeof(ret), "from %s to %s", from, to);

return strlcpy(s, ret, l);
3169}

3171int
3172sshkey_private_serialize_opt(struct sshkey *key, struct sshbuf *buf,
  enum sshkey_serialize_rep opts)
3174{
int r = SSH_ERR_INTERNAL_ERROR-1;
int was_shielded = sshkey_is_shielded(key);
struct sshbuf *b = NULL((void*)0);
3178#ifdef WITH_OPENSSL1
const BIGNUM *rsa_n, *rsa_e, *rsa_d, *rsa_iqmp, *rsa_p, *rsa_q;
const BIGNUM *dsa_p, *dsa_q, *dsa_g, *dsa_pub_key, *dsa_priv_key;
3181#endif /* WITH_OPENSSL */

if ((r = sshkey_unshield_private(key)) != 0)
return r;
if ((b = sshbuf_new()) == NULL((void*)0))
return SSH_ERR_ALLOC_FAIL-2;
if ((r = sshbuf_put_cstring(b, sshkey_ssh_name(key))) != 0)
goto out;
switch (key->type) {
3190#ifdef WITH_OPENSSL1
case KEY_RSA:
RSA_get0_key(key->rsa, &rsa_n, &rsa_e, &rsa_d);
RSA_get0_factors(key->rsa, &rsa_p, &rsa_q);
RSA_get0_crt_params(key->rsa, NULL((void*)0), NULL((void*)0), &rsa_iqmp);
if ((r = sshbuf_put_bignum2(b, rsa_n)) != 0 ||
    (r = sshbuf_put_bignum2(b, rsa_e)) != 0 ||
    (r = sshbuf_put_bignum2(b, rsa_d)) != 0 ||
    (r = sshbuf_put_bignum2(b, rsa_iqmp)) != 0 ||
    (r = sshbuf_put_bignum2(b, rsa_p)) != 0 ||
    (r = sshbuf_put_bignum2(b, rsa_q)) != 0)
	goto out;
break;
case KEY_RSA_CERT:
if (key->cert == NULL((void*)0) || sshbuf_len(key->cert->certblob) == 0) {
	r = SSH_ERR_INVALID_ARGUMENT-10;
	goto out;
}
RSA_get0_key(key->rsa, NULL((void*)0), NULL((void*)0), &rsa_d);
RSA_get0_factors(key->rsa, &rsa_p, &rsa_q);
RSA_get0_crt_params(key->rsa, NULL((void*)0), NULL((void*)0), &rsa_iqmp);
if ((r = sshbuf_put_stringb(b, key->cert->certblob)) != 0 ||
    (r = sshbuf_put_bignum2(b, rsa_d)) != 0 ||
    (r = sshbuf_put_bignum2(b, rsa_iqmp)) != 0 ||
    (r = sshbuf_put_bignum2(b, rsa_p)) != 0 ||
    (r = sshbuf_put_bignum2(b, rsa_q)) != 0)
	goto out;
break;
case KEY_DSA:
DSA_get0_pqg(key->dsa, &dsa_p, &dsa_q, &dsa_g);
DSA_get0_key(key->dsa, &dsa_pub_key, &dsa_priv_key);
if ((r = sshbuf_put_bignum2(b, dsa_p)) != 0 ||
    (r = sshbuf_put_bignum2(b, dsa_q)) != 0 ||
    (r = sshbuf_put_bignum2(b, dsa_g)) != 0 ||
    (r = sshbuf_put_bignum2(b, dsa_pub_key)) != 0 ||
    (r = sshbuf_put_bignum2(b, dsa_priv_key)) != 0)
	goto out;
break;
case KEY_DSA_CERT:
if (key->cert == NULL((void*)0) || sshbuf_len(key->cert->certblob) == 0) {
	r = SSH_ERR_INVALID_ARGUMENT-10;
	goto out;
}
DSA_get0_key(key->dsa, NULL((void*)0), &dsa_priv_key);
if ((r = sshbuf_put_stringb(b, key->cert->certblob)) != 0 ||
    (r = sshbuf_put_bignum2(b, dsa_priv_key)) != 0)
	goto out;
break;
case KEY_ECDSA:
if ((r = sshbuf_put_cstring(b,
    sshkey_curve_nid_to_name(key->ecdsa_nid))) != 0 ||
    (r = sshbuf_put_eckey(b, key->ecdsa)) != 0 ||
    (r = sshbuf_put_bignum2(b,
    EC_KEY_get0_private_key(key->ecdsa))) != 0)
	goto out;
break;
case KEY_ECDSA_CERT:
if (key->cert == NULL((void*)0) || sshbuf_len(key->cert->certblob) == 0) {
	r = SSH_ERR_INVALID_ARGUMENT-10;
	goto out;
}
if ((r = sshbuf_put_stringb(b, key->cert->certblob)) != 0 ||
    (r = sshbuf_put_bignum2(b,
    EC_KEY_get0_private_key(key->ecdsa))) != 0)
	goto out;
break;
case KEY_ECDSA_SK:
if ((r = sshbuf_put_cstring(b,
    sshkey_curve_nid_to_name(key->ecdsa_nid))) != 0 ||
    (r = sshbuf_put_eckey(b, key->ecdsa)) != 0 ||
    (r = sshbuf_put_cstring(b, key->sk_application)) != 0 ||
    (r = sshbuf_put_u8(b, key->sk_flags)) != 0 ||
    (r = sshbuf_put_stringb(b, key->sk_key_handle)) != 0 ||
    (r = sshbuf_put_stringb(b, key->sk_reserved)) != 0)
	goto out;
break;
case KEY_ECDSA_SK_CERT:
if (key->cert == NULL((void*)0) || sshbuf_len(key->cert->certblob) == 0) {
	r = SSH_ERR_INVALID_ARGUMENT-10;
	goto out;
}
if ((r = sshbuf_put_stringb(b, key->cert->certblob)) != 0 ||
    (r = sshbuf_put_cstring(b, key->sk_application)) != 0 ||
    (r = sshbuf_put_u8(b, key->sk_flags)) != 0 ||
    (r = sshbuf_put_stringb(b, key->sk_key_handle)) != 0 ||
    (r = sshbuf_put_stringb(b, key->sk_reserved)) != 0)
	goto out;
break;
3278#endif /* WITH_OPENSSL */
case KEY_ED25519:
if ((r = sshbuf_put_string(b, key->ed25519_pk,
    ED25519_PK_SZ32U)) != 0 ||
    (r = sshbuf_put_string(b, key->ed25519_sk,
    ED25519_SK_SZ64U)) != 0)
	goto out;
break;
case KEY_ED25519_CERT:
if (key->cert == NULL((void*)0) || sshbuf_len(key->cert->certblob) == 0) {
	r = SSH_ERR_INVALID_ARGUMENT-10;
	goto out;
}
if ((r = sshbuf_put_stringb(b, key->cert->certblob)) != 0 ||
    (r = sshbuf_put_string(b, key->ed25519_pk,
    ED25519_PK_SZ32U)) != 0 ||
    (r = sshbuf_put_string(b, key->ed25519_sk,
    ED25519_SK_SZ64U)) != 0)
	goto out;
break;
case KEY_ED25519_SK:
if ((r = sshbuf_put_string(b, key->ed25519_pk,
    ED25519_PK_SZ32U)) != 0 ||
    (r = sshbuf_put_cstring(b, key->sk_application)) != 0 ||
    (r = sshbuf_put_u8(b, key->sk_flags)) != 0 ||
    (r = sshbuf_put_stringb(b, key->sk_key_handle)) != 0 ||
    (r = sshbuf_put_stringb(b, key->sk_reserved)) != 0)
	goto out;
break;
case KEY_ED25519_SK_CERT:
if (key->cert == NULL((void*)0) || sshbuf_len(key->cert->certblob) == 0) {
	r = SSH_ERR_INVALID_ARGUMENT-10;
	goto out;
}
if ((r = sshbuf_put_stringb(b, key->cert->certblob)) != 0 ||
    (r = sshbuf_put_string(b, key->ed25519_pk,
    ED25519_PK_SZ32U)) != 0 ||
    (r = sshbuf_put_cstring(b, key->sk_application)) != 0 ||
    (r = sshbuf_put_u8(b, key->sk_flags)) != 0 ||
    (r = sshbuf_put_stringb(b, key->sk_key_handle)) != 0 ||
    (r = sshbuf_put_stringb(b, key->sk_reserved)) != 0)
	goto out;
break;
3321#ifdef WITH_XMSS
case KEY_XMSS:
if (key->xmss_name == NULL((void*)0)) {
	r = SSH_ERR_INVALID_ARGUMENT-10;
	goto out;
}
if ((r = sshbuf_put_cstring(b, key->xmss_name)) != 0 ||
    (r = sshbuf_put_string(b, key->xmss_pk,
    sshkey_xmss_pklen(key))) != 0 ||
    (r = sshbuf_put_string(b, key->xmss_sk,
    sshkey_xmss_sklen(key))) != 0 ||
    (r = sshkey_xmss_serialize_state_opt(key, b, opts)) != 0)
	goto out;
break;
case KEY_XMSS_CERT:
if (key->cert == NULL((void*)0) || sshbuf_len(key->cert->certblob) == 0 ||
    key->xmss_name == NULL((void*)0)) {
	r = SSH_ERR_INVALID_ARGUMENT-10;
	goto out;
}
if ((r = sshbuf_put_stringb(b, key->cert->certblob)) != 0 ||
    (r = sshbuf_put_cstring(b, key->xmss_name)) != 0 ||
    (r = sshbuf_put_string(b, key->xmss_pk,
    sshkey_xmss_pklen(key))) != 0 ||
    (r = sshbuf_put_string(b, key->xmss_sk,
    sshkey_xmss_sklen(key))) != 0 ||
    (r = sshkey_xmss_serialize_state_opt(key, b, opts)) != 0)
	goto out;
break;
3350#endif /* WITH_XMSS */
default:
r = SSH_ERR_INVALID_ARGUMENT-10;
goto out;
}
/*
* success (but we still need to append the output to buf after
* possibly re-shielding the private key)
*/
r = 0;
out:
if (was_shielded)
r = sshkey_shield_private(key);
if (r == 0)
r = sshbuf_putb(buf, b);
sshbuf_free(b);

return r;
3368}

3370int
3371sshkey_private_serialize(struct sshkey *key, struct sshbuf *b)
3372{
return sshkey_private_serialize_opt(key, b,
   SSHKEY_SERIALIZE_DEFAULT);
3375}

3377int
3378sshkey_private_deserialize(struct sshbuf *buf, struct sshkey **kp)
3379{
char *tname = NULL((void*)0), *curve = NULL((void*)0), *xmss_name = NULL((void*)0);
char *expect_sk_application = NULL((void*)0);
struct sshkey *k = NULL((void*)0);
size_t pklen = 0, sklen = 0;
int type, r = SSH_ERR_INTERNAL_ERROR-1;
u_char *ed25519_pk = NULL((void*)0), *ed25519_sk = NULL((void*)0);
u_char *expect_ed25519_pk = NULL((void*)0);
u_char *xmss_pk = NULL((void*)0), *xmss_sk = NULL((void*)0);
3388#ifdef WITH_OPENSSL1
BIGNUM *exponent = NULL((void*)0);
BIGNUM *rsa_n = NULL((void*)0), *rsa_e = NULL((void*)0), *rsa_d = NULL((void*)0);
BIGNUM *rsa_iqmp = NULL((void*)0), *rsa_p = NULL((void*)0), *rsa_q = NULL((void*)0);
BIGNUM *dsa_p = NULL((void*)0), *dsa_q = NULL((void*)0), *dsa_g = NULL((void*)0);
BIGNUM *dsa_pub_key = NULL((void*)0), *dsa_priv_key = NULL((void*)0);
3394#endif /* WITH_OPENSSL */

if (kp != NULL((void*)0))
*kp = NULL((void*)0);
if ((r = sshbuf_get_cstring(buf, &tname, NULL((void*)0))) != 0)
goto out;
type = sshkey_type_from_name(tname);
if (sshkey_type_is_cert(type)) {
/*
 * Certificate key private keys begin with the certificate
 * itself. Make sure this matches the type of the enclosing
 * private key.
 */
if ((r = sshkey_froms(buf, &k)) != 0)
	goto out;
if (k->type != type) {
	r = SSH_ERR_KEY_CERT_MISMATCH-45;
	goto out;
}
/* For ECDSA keys, the group must match too */
if (k->type == KEY_ECDSA &&
    k->ecdsa_nid != sshkey_ecdsa_nid_from_name(tname)) {
	r = SSH_ERR_KEY_CERT_MISMATCH-45;
	goto out;
}
/*
 * Several fields are redundant between certificate and
 * private key body, we require these to match.
 */
expect_sk_application = k->sk_application;
expect_ed25519_pk = k->ed25519_pk;
k->sk_application = NULL((void*)0);
k->ed25519_pk = NULL((void*)0);
} else {
if ((k = sshkey_new(type)) == NULL((void*)0)) {
	r = SSH_ERR_ALLOC_FAIL-2;
	goto out;
}
}
switch (type) {
3434#ifdef WITH_OPENSSL1
case KEY_DSA:
if ((r = sshbuf_get_bignum2(buf, &dsa_p)) != 0 ||
    (r = sshbuf_get_bignum2(buf, &dsa_q)) != 0 ||
    (r = sshbuf_get_bignum2(buf, &dsa_g)) != 0 ||
    (r = sshbuf_get_bignum2(buf, &dsa_pub_key)) != 0)
	goto out;
if (!DSA_set0_pqg(k->dsa, dsa_p, dsa_q, dsa_g)) {
	r = SSH_ERR_LIBCRYPTO_ERROR-22;
	goto out;
}
dsa_p = dsa_q = dsa_g = NULL((void*)0); /* transferred */
if (!DSA_set0_key(k->dsa, dsa_pub_key, NULL((void*)0))) {
	r = SSH_ERR_LIBCRYPTO_ERROR-22;
	goto out;
}
dsa_pub_key = NULL((void*)0); /* transferred */
/* FALLTHROUGH */
case KEY_DSA_CERT:
if ((r = sshbuf_get_bignum2(buf, &dsa_priv_key)) != 0)
	goto out;
if (!DSA_set0_key(k->dsa, NULL((void*)0), dsa_priv_key)) {
	r = SSH_ERR_LIBCRYPTO_ERROR-22;
	goto out;
}
dsa_priv_key = NULL((void*)0); /* transferred */
break;
case KEY_ECDSA:
if ((k->ecdsa_nid = sshkey_ecdsa_nid_from_name(tname)) == -1) {
	r = SSH_ERR_INVALID_ARGUMENT-10;
	goto out;
}
if ((r = sshbuf_get_cstring(buf, &curve, NULL((void*)0))) != 0)
	goto out;
if (k->ecdsa_nid != sshkey_curve_name_to_nid(curve)) {
	r = SSH_ERR_EC_CURVE_MISMATCH-15;
	goto out;
}
k->ecdsa = EC_KEY_new_by_curve_name(k->ecdsa_nid);
if (k->ecdsa  == NULL((void*)0)) {
	r = SSH_ERR_LIBCRYPTO_ERROR-22;
	goto out;
}
if ((r = sshbuf_get_eckey(buf, k->ecdsa)) != 0)
	goto out;
/* FALLTHROUGH */
case KEY_ECDSA_CERT:
if ((r = sshbuf_get_bignum2(buf, &exponent)) != 0)
	goto out;
if (EC_KEY_set_private_key(k->ecdsa, exponent) != 1) {
	r = SSH_ERR_LIBCRYPTO_ERROR-22;
	goto out;
}
if ((r = sshkey_ec_validate_public(EC_KEY_get0_group(k->ecdsa),
    EC_KEY_get0_public_key(k->ecdsa))) != 0 ||
    (r = sshkey_ec_validate_private(k->ecdsa)) != 0)
	goto out;
break;
case KEY_ECDSA_SK:
if ((k->ecdsa_nid = sshkey_ecdsa_nid_from_name(tname)) == -1) {
	r = SSH_ERR_INVALID_ARGUMENT-10;
	goto out;
}
if ((r = sshbuf_get_cstring(buf, &curve, NULL((void*)0))) != 0)
	goto out;
if (k->ecdsa_nid != sshkey_curve_name_to_nid(curve)) {
	r = SSH_ERR_EC_CURVE_MISMATCH-15;
	goto out;
}
if ((k->sk_key_handle = sshbuf_new()) == NULL((void*)0) ||
    (k->sk_reserved = sshbuf_new()) == NULL((void*)0)) {
	r = SSH_ERR_ALLOC_FAIL-2;
	goto out;
}
k->ecdsa = EC_KEY_new_by_curve_name(k->ecdsa_nid);
if (k->ecdsa  == NULL((void*)0)) {
	r = SSH_ERR_LIBCRYPTO_ERROR-22;
	goto out;
}
if ((r = sshbuf_get_eckey(buf, k->ecdsa)) != 0 ||
    (r = sshbuf_get_cstring(buf, &k->sk_application,
    NULL((void*)0))) != 0 ||
    (r = sshbuf_get_u8(buf, &k->sk_flags)) != 0 ||
    (r = sshbuf_get_stringb(buf, k->sk_key_handle)) != 0 ||
    (r = sshbuf_get_stringb(buf, k->sk_reserved)) != 0)
	goto out;
if ((r = sshkey_ec_validate_public(EC_KEY_get0_group(k->ecdsa),
    EC_KEY_get0_public_key(k->ecdsa))) != 0)
	goto out;
break;
case KEY_ECDSA_SK_CERT:
if ((k->sk_key_handle = sshbuf_new()) == NULL((void*)0) ||
    (k->sk_reserved = sshbuf_new()) == NULL((void*)0)) {
	r = SSH_ERR_ALLOC_FAIL-2;
	goto out;
}
if ((r = sshbuf_get_cstring(buf, &k->sk_application,
    NULL((void*)0))) != 0 ||
    (r = sshbuf_get_u8(buf, &k->sk_flags)) != 0 ||
    (r = sshbuf_get_stringb(buf, k->sk_key_handle)) != 0 ||
    (r = sshbuf_get_stringb(buf, k->sk_reserved)) != 0)
	goto out;
if ((r = sshkey_ec_validate_public(EC_KEY_get0_group(k->ecdsa),
    EC_KEY_get0_public_key(k->ecdsa))) != 0)
	goto out;
break;
case KEY_RSA:
if ((r = sshbuf_get_bignum2(buf, &rsa_n)) != 0 ||
    (r = sshbuf_get_bignum2(buf, &rsa_e)) != 0)
	goto out;
if (!RSA_set0_key(k->rsa, rsa_n, rsa_e, NULL((void*)0))) {
	r = SSH_ERR_LIBCRYPTO_ERROR-22;
	goto out;
}
rsa_n = rsa_e = NULL((void*)0); /* transferred */
/* FALLTHROUGH */
case KEY_RSA_CERT:
if ((r = sshbuf_get_bignum2(buf, &rsa_d)) != 0 ||
    (r = sshbuf_get_bignum2(buf, &rsa_iqmp)) != 0 ||
    (r = sshbuf_get_bignum2(buf, &rsa_p)) != 0 ||
    (r = sshbuf_get_bignum2(buf, &rsa_q)) != 0)
	goto out;
if (!RSA_set0_key(k->rsa, NULL((void*)0), NULL((void*)0), rsa_d)) {
	r = SSH_ERR_LIBCRYPTO_ERROR-22;
	goto out;
}
rsa_d = NULL((void*)0); /* transferred */
if (!RSA_set0_factors(k->rsa, rsa_p, rsa_q)) {
	r = SSH_ERR_LIBCRYPTO_ERROR-22;
	goto out;
}
rsa_p = rsa_q = NULL((void*)0); /* transferred */
if ((r = check_rsa_length(k->rsa)) != 0)
	goto out;
if ((r = ssh_rsa_complete_crt_parameters(k, rsa_iqmp)) != 0)
	goto out;
break;
3571#endif /* WITH_OPENSSL */
case KEY_ED25519:
case KEY_ED25519_CERT:
if ((r = sshbuf_get_string(buf, &ed25519_pk, &pklen)) != 0 ||
    (r = sshbuf_get_string(buf, &ed25519_sk, &sklen)) != 0)
	goto out;
if (pklen != ED25519_PK_SZ32U || sklen != ED25519_SK_SZ64U) {
	r = SSH_ERR_INVALID_FORMAT-4;
	goto out;
}
k->ed25519_pk = ed25519_pk;
k->ed25519_sk = ed25519_sk;
ed25519_pk = ed25519_sk = NULL((void*)0); /* transferred */
break;
case KEY_ED25519_SK:
case KEY_ED25519_SK_CERT:
if ((r = sshbuf_get_string(buf, &ed25519_pk, &pklen)) != 0)
	goto out;
if (pklen != ED25519_PK_SZ32U) {
	r = SSH_ERR_INVALID_FORMAT-4;
	goto out;
}
if ((k->sk_key_handle = sshbuf_new()) == NULL((void*)0) ||
    (k->sk_reserved = sshbuf_new()) == NULL((void*)0)) {
	r = SSH_ERR_ALLOC_FAIL-2;
	goto out;
}
if ((r = sshbuf_get_cstring(buf, &k->sk_application,
    NULL((void*)0))) != 0 ||
    (r = sshbuf_get_u8(buf, &k->sk_flags)) != 0 ||
    (r = sshbuf_get_stringb(buf, k->sk_key_handle)) != 0 ||
    (r = sshbuf_get_stringb(buf, k->sk_reserved)) != 0)
	goto out;
k->ed25519_pk = ed25519_pk;
ed25519_pk = NULL((void*)0); /* transferred */
break;
3607#ifdef WITH_XMSS
case KEY_XMSS:
case KEY_XMSS_CERT:
if ((r = sshbuf_get_cstring(buf, &xmss_name, NULL((void*)0))) != 0 ||
    (r = sshbuf_get_string(buf, &xmss_pk, &pklen)) != 0 ||
    (r = sshbuf_get_string(buf, &xmss_sk, &sklen)) != 0)
	goto out;
if (type == KEY_XMSS &&
    (r = sshkey_xmss_init(k, xmss_name)) != 0)
	goto out;
if (pklen != sshkey_xmss_pklen(k) ||
    sklen != sshkey_xmss_sklen(k)) {
	r = SSH_ERR_INVALID_FORMAT-4;
	goto out;
}
k->xmss_pk = xmss_pk;
k->xmss_sk = xmss_sk;
xmss_pk = xmss_sk = NULL((void*)0);
/* optional internal state */
if ((r = sshkey_xmss_deserialize_state_opt(k, buf)) != 0)
	goto out;
break;
3629#endif /* WITH_XMSS */
default:
r = SSH_ERR_KEY_TYPE_UNKNOWN-14;
goto out;
}
3634#ifdef WITH_OPENSSL1
/* enable blinding */
switch (k->type) {
case KEY_RSA:
case KEY_RSA_CERT:
if (RSA_blinding_on(k->rsa, NULL((void*)0)) != 1) {
	r = SSH_ERR_LIBCRYPTO_ERROR-22;
	goto out;
}
break;
}
3645#endif /* WITH_OPENSSL */
if ((expect_sk_application != NULL((void*)0) && (k->sk_application == NULL((void*)0) ||
   strcmp(expect_sk_application, k->sk_application) != 0)) ||
   (expect_ed25519_pk != NULL((void*)0) && (k->ed25519_pk == NULL((void*)0) ||
   memcmp(expect_ed25519_pk, k->ed25519_pk, ED25519_PK_SZ32U) != 0))) {
r = SSH_ERR_KEY_CERT_MISMATCH-45;
goto out;
}
/* success */
r = 0;
if (kp != NULL((void*)0)) {
*kp = k;
k = NULL((void*)0);
}
out:
free(tname);
free(curve);
3662#ifdef WITH_OPENSSL1
BN_clear_free(exponent);
BN_clear_free(dsa_p);
BN_clear_free(dsa_q);
BN_clear_free(dsa_g);
BN_clear_free(dsa_pub_key);
BN_clear_free(dsa_priv_key);
BN_clear_free(rsa_n);
BN_clear_free(rsa_e);
BN_clear_free(rsa_d);
BN_clear_free(rsa_p);
BN_clear_free(rsa_q);
BN_clear_free(rsa_iqmp);
3675#endif /* WITH_OPENSSL */
sshkey_free(k);
freezero(ed25519_pk, pklen);
freezero(ed25519_sk, sklen);
free(xmss_name);
freezero(xmss_pk, pklen);
freezero(xmss_sk, sklen);
free(expect_sk_application);
free(expect_ed25519_pk);
return r;
3685}

3687#ifdef WITH_OPENSSL1
3688int
3689sshkey_ec_validate_public(const EC_GROUP *group, const EC_POINT *public)
3690{
EC_POINT *nq = NULL((void*)0);
BIGNUM *order = NULL((void*)0), *x = NULL((void*)0), *y = NULL((void*)0), *tmp = NULL((void*)0);
int ret = SSH_ERR_KEY_INVALID_EC_VALUE-20;

/*
* NB. This assumes OpenSSL has already verified that the public
* point lies on the curve. This is done by EC_POINT_oct2point()
* implicitly calling EC_POINT_is_on_curve(). If this code is ever
* reachable with public points not unmarshalled using
* EC_POINT_oct2point then the caller will need to explicitly check.
*/

/*
* We shouldn't ever hit this case because bignum_get_ecpoint()
* refuses to load GF2m points.
*/
if (EC_METHOD_get_field_type(EC_GROUP_method_of(group)) !=
   NID_X9_62_prime_field406)
goto out;

/* Q != infinity */
if (EC_POINT_is_at_infinity(group, public))
goto out;

if ((x = BN_new()) == NULL((void*)0) ||
   (y = BN_new()) == NULL((void*)0) ||
   (order = BN_new()) == NULL((void*)0) ||
   (tmp = BN_new()) == NULL((void*)0)) {
ret = SSH_ERR_ALLOC_FAIL-2;
goto out;
}

/* log2(x) > log2(order)/2, log2(y) > log2(order)/2 */
if (EC_GROUP_get_order(group, order, NULL((void*)0)) != 1 ||
   EC_POINT_get_affine_coordinates_GFp(group, public,
   x, y, NULL((void*)0)) != 1) {
ret = SSH_ERR_LIBCRYPTO_ERROR-22;
goto out;
}
if (BN_num_bits(x) <= BN_num_bits(order) / 2 ||
   BN_num_bits(y) <= BN_num_bits(order) / 2)
goto out;

/* nQ == infinity (n == order of subgroup) */
if ((nq = EC_POINT_new(group)) == NULL((void*)0)) {
ret = SSH_ERR_ALLOC_FAIL-2;
goto out;
}
if (EC_POINT_mul(group, nq, NULL((void*)0), public, order, NULL((void*)0)) != 1) {
ret = SSH_ERR_LIBCRYPTO_ERROR-22;
goto out;
}
if (EC_POINT_is_at_infinity(group, nq) != 1)
goto out;

/* x < order - 1, y < order - 1 */
if (!BN_sub(tmp, order, BN_value_one())) {
ret = SSH_ERR_LIBCRYPTO_ERROR-22;
goto out;
}
if (BN_cmp(x, tmp) >= 0 || BN_cmp(y, tmp) >= 0)
goto out;
ret = 0;
out:
BN_clear_free(x);
BN_clear_free(y);
BN_clear_free(order);
BN_clear_free(tmp);
EC_POINT_free(nq);
return ret;
3761}

3763int
3764sshkey_ec_validate_private(const EC_KEY *key)
3765{
BIGNUM *order = NULL((void*)0), *tmp = NULL((void*)0);
int ret = SSH_ERR_KEY_INVALID_EC_VALUE-20;

if ((order = BN_new()) == NULL((void*)0) || (tmp = BN_new()) == NULL((void*)0)) {
ret = SSH_ERR_ALLOC_FAIL-2;
goto out;
}

/* log2(private) > log2(order)/2 */
if (EC_GROUP_get_order(EC_KEY_get0_group(key), order, NULL((void*)0)) != 1) {
ret = SSH_ERR_LIBCRYPTO_ERROR-22;
goto out;
}
if (BN_num_bits(EC_KEY_get0_private_key(key)) <=
   BN_num_bits(order) / 2)
goto out;

/* private < order - 1 */
if (!BN_sub(tmp, order, BN_value_one())) {
ret = SSH_ERR_LIBCRYPTO_ERROR-22;
goto out;
}
if (BN_cmp(EC_KEY_get0_private_key(key), tmp) >= 0)
goto out;
ret = 0;
out:
BN_clear_free(order);
BN_clear_free(tmp);
return ret;
3795}

3797void
3798sshkey_dump_ec_point(const EC_GROUP *group, const EC_POINT *point)
3799{
BIGNUM *x = NULL((void*)0), *y = NULL((void*)0);

if (point == NULL((void*)0)) {
fputs("point=(NULL)\n", stderr(&__sF[2]));
return;
}
if ((x = BN_new()) == NULL((void*)0) || (y = BN_new()) == NULL((void*)0)) {
fprintf(stderr(&__sF[2]), "%s: BN_new failed\n", __func__);
goto out;
}
if (EC_METHOD_get_field_type(EC_GROUP_method_of(group)) !=
   NID_X9_62_prime_field406) {
fprintf(stderr(&__sF[2]), "%s: group is not a prime field\n", __func__);
goto out;
}
if (EC_POINT_get_affine_coordinates_GFp(group, point,
   x, y, NULL((void*)0)) != 1) {
fprintf(stderr(&__sF[2]), "%s: EC_POINT_get_affine_coordinates_GFp\n",
    __func__);
goto out;
}
fputs("x=", stderr(&__sF[2]));
BN_print_fp(stderr(&__sF[2]), x);
fputs("\ny=", stderr(&__sF[2]));
BN_print_fp(stderr(&__sF[2]), y);
fputs("\n", stderr(&__sF[2]));
out:
BN_clear_free(x);
BN_clear_free(y);
3829}

3831void
3832sshkey_dump_ec_key(const EC_KEY *key)
3833{
const BIGNUM *exponent;

sshkey_dump_ec_point(EC_KEY_get0_group(key),
   EC_KEY_get0_public_key(key));
fputs("exponent=", stderr(&__sF[2]));
if ((exponent = EC_KEY_get0_private_key(key)) == NULL((void*)0))
fputs("(NULL)", stderr(&__sF[2]));
else
BN_print_fp(stderr(&__sF[2]), EC_KEY_get0_private_key(key));
fputs("\n", stderr(&__sF[2]));
3844}
3845#endif /* WITH_OPENSSL */

3847static int
3848sshkey_private_to_blob2(struct sshkey *prv, struct sshbuf *blob,
  const char *passphrase, const char *comment, const char *ciphername,
  int rounds)
3851{
u_char *cp, *key = NULL((void*)0), *pubkeyblob = NULL((void*)0);
u_char salt[SALT_LEN16];
char *b64 = NULL((void*)0);
size_t i, pubkeylen, keylen, ivlen, blocksize, authlen;
u_int check;
int r = SSH_ERR_INTERNAL_ERROR-1;
struct sshcipher_ctx *ciphercontext = NULL((void*)0);
const struct sshcipher *cipher;
const char *kdfname = KDFNAME"bcrypt";
struct sshbuf *encoded = NULL((void*)0), *encrypted = NULL((void*)0), *kdf = NULL((void*)0);

if (rounds <= 0)
rounds = DEFAULT_ROUNDS16;
if (passphrase == NULL((void*)0) || !strlen(passphrase)) {
ciphername = "none";
kdfname = "none";
} else if (ciphername == NULL((void*)0))
ciphername = DEFAULT_CIPHERNAME"aes256-ctr";
if ((cipher = cipher_by_name(ciphername)) == NULL((void*)0)) {
r = SSH_ERR_INVALID_ARGUMENT-10;
goto out;
}

if ((kdf = sshbuf_new()) == NULL((void*)0) ||
   (encoded = sshbuf_new()) == NULL((void*)0) ||
   (encrypted = sshbuf_new()) == NULL((void*)0)) {
r = SSH_ERR_ALLOC_FAIL-2;
goto out;
}
blocksize = cipher_blocksize(cipher);
keylen = cipher_keylen(cipher);
ivlen = cipher_ivlen(cipher);
authlen = cipher_authlen(cipher);
if ((key = calloc(1, keylen + ivlen)) == NULL((void*)0)) {
r = SSH_ERR_ALLOC_FAIL-2;
goto out;
}
if (strcmp(kdfname, "bcrypt") == 0) {
arc4random_buf(salt, SALT_LEN16);
if (bcrypt_pbkdf(passphrase, strlen(passphrase),
    salt, SALT_LEN16, key, keylen + ivlen, rounds) < 0) {
	r = SSH_ERR_INVALID_ARGUMENT-10;
	goto out;
}
if ((r = sshbuf_put_string(kdf, salt, SALT_LEN16)) != 0 ||
    (r = sshbuf_put_u32(kdf, rounds)) != 0)
	goto out;
} else if (strcmp(kdfname, "none") != 0) {
/* Unsupported KDF type */
r = SSH_ERR_KEY_UNKNOWN_CIPHER-42;
goto out;
}
if ((r = cipher_init(&ciphercontext, cipher, key, keylen,
   key + keylen, ivlen, 1)) != 0)
goto out;

if ((r = sshbuf_put(encoded, AUTH_MAGIC"openssh-key-v1", sizeof(AUTH_MAGIC"openssh-key-v1"))) != 0 ||
   (r = sshbuf_put_cstring(encoded, ciphername)) != 0 ||
   (r = sshbuf_put_cstring(encoded, kdfname)) != 0 ||
   (r = sshbuf_put_stringb(encoded, kdf)) != 0 ||
   (r = sshbuf_put_u32(encoded, 1)) != 0 ||	/* number of keys */
   (r = sshkey_to_blob(prv, &pubkeyblob, &pubkeylen)) != 0 ||
   (r = sshbuf_put_string(encoded, pubkeyblob, pubkeylen)) != 0)
goto out;

/* set up the buffer that will be encrypted */

/* Random check bytes */
check = arc4random();
if ((r = sshbuf_put_u32(encrypted, check)) != 0 ||
   (r = sshbuf_put_u32(encrypted, check)) != 0)
goto out;

/* append private key and comment*/
if ((r = sshkey_private_serialize_opt(prv, encrypted,
   SSHKEY_SERIALIZE_FULL)) != 0 ||
   (r = sshbuf_put_cstring(encrypted, comment)) != 0)
goto out;

/* padding */
i = 0;
while (sshbuf_len(encrypted) % blocksize) {
if ((r = sshbuf_put_u8(encrypted, ++i & 0xff)) != 0)
	goto out;
}

/* length in destination buffer */
if ((r = sshbuf_put_u32(encoded, sshbuf_len(encrypted))) != 0)
goto out;

/* encrypt */
if ((r = sshbuf_reserve(encoded,
   sshbuf_len(encrypted) + authlen, &cp)) != 0)
goto out;
if ((r = cipher_crypt(ciphercontext, 0, cp,
   sshbuf_ptr(encrypted), sshbuf_len(encrypted), 0, authlen)) != 0)
goto out;

sshbuf_reset(blob);

/* assemble uuencoded key */
if ((r = sshbuf_put(blob, MARK_BEGIN"-----BEGIN OPENSSH PRIVATE KEY-----\n", MARK_BEGIN_LEN(sizeof("-----BEGIN OPENSSH PRIVATE KEY-----\n") - 1))) != 0 ||
   (r = sshbuf_dtob64(encoded, blob, 1)) != 0 ||
   (r = sshbuf_put(blob, MARK_END"-----END OPENSSH PRIVATE KEY-----\n", MARK_END_LEN(sizeof("-----END OPENSSH PRIVATE KEY-----\n") - 1))) != 0)
goto out;

/* success */
r = 0;

out:
sshbuf_free(kdf);
sshbuf_free(encoded);
sshbuf_free(encrypted);
cipher_free(ciphercontext);
explicit_bzero(salt, sizeof(salt));
if (key != NULL((void*)0))
freezero(key, keylen + ivlen);
if (pubkeyblob != NULL((void*)0)) 
freezero(pubkeyblob, pubkeylen);
if (b64 != NULL((void*)0)) 
freezero(b64, strlen(b64));
return r;
3974}

3976static int
3977private2_uudecode(struct sshbuf *blob, struct sshbuf **decodedp)
3978{
const u_char *cp;
size_t encoded_len;
int r;
u_char last;
struct sshbuf *encoded = NULL((void*)0), *decoded = NULL((void*)0);

if (blob == NULL((void*)0) || decodedp == NULL((void*)0))
return SSH_ERR_INVALID_ARGUMENT-10;

*decodedp = NULL((void*)0);

if ((encoded = sshbuf_new()) == NULL((void*)0) ||
   (decoded = sshbuf_new()) == NULL((void*)0)) {
r = SSH_ERR_ALLOC_FAIL-2;
goto out;
}

/* check preamble */
cp = sshbuf_ptr(blob);
encoded_len = sshbuf_len(blob);
if (encoded_len < (MARK_BEGIN_LEN(sizeof("-----BEGIN OPENSSH PRIVATE KEY-----\n") - 1) + MARK_END_LEN(sizeof("-----END OPENSSH PRIVATE KEY-----\n") - 1)) ||
   memcmp(cp, MARK_BEGIN"-----BEGIN OPENSSH PRIVATE KEY-----\n", MARK_BEGIN_LEN(sizeof("-----BEGIN OPENSSH PRIVATE KEY-----\n") - 1)) != 0) {
r = SSH_ERR_INVALID_FORMAT-4;
goto out;
}
cp += MARK_BEGIN_LEN(sizeof("-----BEGIN OPENSSH PRIVATE KEY-----\n") - 1);
encoded_len -= MARK_BEGIN_LEN(sizeof("-----BEGIN OPENSSH PRIVATE KEY-----\n") - 1);

/* Look for end marker, removing whitespace as we go */
while (encoded_len > 0) {
if (*cp != '\n' && *cp != '\r') {
	if ((r = sshbuf_put_u8(encoded, *cp)) != 0)
		goto out;
}
last = *cp;
encoded_len--;
cp++;
if (last == '\n') {
	if (encoded_len >= MARK_END_LEN(sizeof("-----END OPENSSH PRIVATE KEY-----\n") - 1) &&
	    memcmp(cp, MARK_END"-----END OPENSSH PRIVATE KEY-----\n", MARK_END_LEN(sizeof("-----END OPENSSH PRIVATE KEY-----\n") - 1)) == 0) {
		/* \0 terminate */
		if ((r = sshbuf_put_u8(encoded, 0)) != 0)
			goto out;
		break;
	}
}
}
if (encoded_len == 0) {
r = SSH_ERR_INVALID_FORMAT-4;
goto out;
}

/* decode base64 */
if ((r = sshbuf_b64tod(decoded, (char *)sshbuf_ptr(encoded))) != 0)
goto out;

/* check magic */
if (sshbuf_len(decoded) < sizeof(AUTH_MAGIC"openssh-key-v1") ||
   memcmp(sshbuf_ptr(decoded), AUTH_MAGIC"openssh-key-v1", sizeof(AUTH_MAGIC"openssh-key-v1"))) {
r = SSH_ERR_INVALID_FORMAT-4;
goto out;
}
/* success */
*decodedp = decoded;
decoded = NULL((void*)0);
r = 0;
out:
sshbuf_free(encoded);
sshbuf_free(decoded);
return r;
4049}

4051static int
4052private2_decrypt(struct sshbuf *decoded, const char *passphrase,
  struct sshbuf **decryptedp, struct sshkey **pubkeyp)
4054{
char *ciphername = NULL((void*)0), *kdfname = NULL((void*)0);
const struct sshcipher *cipher = NULL((void*)0);
int r = SSH_ERR_INTERNAL_ERROR-1;
size_t keylen = 0, ivlen = 0, authlen = 0, slen = 0;
struct sshbuf *kdf = NULL((void*)0), *decrypted = NULL((void*)0);
struct sshcipher_ctx *ciphercontext = NULL((void*)0);
struct sshkey *pubkey = NULL((void*)0);
u_char *key = NULL((void*)0), *salt = NULL((void*)0), *dp;
u_int blocksize, rounds, nkeys, encrypted_len, check1, check2;

if (decoded == NULL((void*)0) || decryptedp == NULL((void*)0) || pubkeyp == NULL((void*)0))
return SSH_ERR_INVALID_ARGUMENT-10;

*decryptedp = NULL((void*)0);
*pubkeyp = NULL((void*)0);

if ((decrypted = sshbuf_new()) == NULL((void*)0)) {
r = SSH_ERR_ALLOC_FAIL-2;
goto out;
}

/* parse public portion of key */
if ((r = sshbuf_consume(decoded, sizeof(AUTH_MAGIC"openssh-key-v1"))) != 0 ||
   (r = sshbuf_get_cstring(decoded, &ciphername, NULL((void*)0))) != 0 ||
   (r = sshbuf_get_cstring(decoded, &kdfname, NULL((void*)0))) != 0 ||
   (r = sshbuf_froms(decoded, &kdf)) != 0 ||
   (r = sshbuf_get_u32(decoded, &nkeys)) != 0)
goto out;

if (nkeys != 1) {
/* XXX only one key supported at present */
r = SSH_ERR_INVALID_FORMAT-4;
goto out;
}

if ((r = sshkey_froms(decoded, &pubkey)) != 0 ||
   (r = sshbuf_get_u32(decoded, &encrypted_len)) != 0)
goto out;

if ((cipher = cipher_by_name(ciphername)) == NULL((void*)0)) {
r = SSH_ERR_KEY_UNKNOWN_CIPHER-42;
goto out;
}
if (strcmp(kdfname, "none") != 0 && strcmp(kdfname, "bcrypt") != 0) {
r = SSH_ERR_KEY_UNKNOWN_CIPHER-42;
goto out;
}
if (strcmp(kdfname, "none") == 0 && strcmp(ciphername, "none") != 0) {
r = SSH_ERR_INVALID_FORMAT-4;
goto out;
}
if ((passphrase == NULL((void*)0) || strlen(passphrase) == 0) &&
   strcmp(kdfname, "none") != 0) {
/* passphrase required */
r = SSH_ERR_KEY_WRONG_PASSPHRASE-43;
goto out;
}

/* check size of encrypted key blob */
blocksize = cipher_blocksize(cipher);
if (encrypted_len < blocksize || (encrypted_len % blocksize) != 0) {
r = SSH_ERR_INVALID_FORMAT-4;
goto out;
}

/* setup key */
keylen = cipher_keylen(cipher);
ivlen = cipher_ivlen(cipher);
authlen = cipher_authlen(cipher);
if ((key = calloc(1, keylen + ivlen)) == NULL((void*)0)) {
r = SSH_ERR_ALLOC_FAIL-2;
goto out;
}
if (strcmp(kdfname, "bcrypt") == 0) {
if ((r = sshbuf_get_string(kdf, &salt, &slen)) != 0 ||
    (r = sshbuf_get_u32(kdf, &rounds)) != 0)
	goto out;
if (bcrypt_pbkdf(passphrase, strlen(passphrase), salt, slen,
    key, keylen + ivlen, rounds) < 0) {
	r = SSH_ERR_INVALID_FORMAT-4;
	goto out;
}
}

/* check that an appropriate amount of auth data is present */
if (sshbuf_len(decoded) < authlen ||
   sshbuf_len(decoded) - authlen < encrypted_len) {
r = SSH_ERR_INVALID_FORMAT-4;
goto out;
}

/* decrypt private portion of key */
if ((r = sshbuf_reserve(decrypted, encrypted_len, &dp)) != 0 ||
   (r = cipher_init(&ciphercontext, cipher, key, keylen,
   key + keylen, ivlen, 0)) != 0)
goto out;
if ((r = cipher_crypt(ciphercontext, 0, dp, sshbuf_ptr(decoded),
   encrypted_len, 0, authlen)) != 0) {
/* an integrity error here indicates an incorrect passphrase */
if (r == SSH_ERR_MAC_INVALID-30)
	r = SSH_ERR_KEY_WRONG_PASSPHRASE-43;
goto out;
}
if ((r = sshbuf_consume(decoded, encrypted_len + authlen)) != 0)
goto out;
/* there should be no trailing data */
if (sshbuf_len(decoded) != 0) {
r = SSH_ERR_INVALID_FORMAT-4;
goto out;
}

/* check check bytes */
if ((r = sshbuf_get_u32(decrypted, &check1)) != 0 ||
   (r = sshbuf_get_u32(decrypted, &check2)) != 0)
goto out;
if (check1 != check2) {
r = SSH_ERR_KEY_WRONG_PASSPHRASE-43;
goto out;
}
/* success */
*decryptedp = decrypted;
decrypted = NULL((void*)0);
*pubkeyp = pubkey;
pubkey = NULL((void*)0);
r = 0;
out:
cipher_free(ciphercontext);
free(ciphername);
free(kdfname);
sshkey_free(pubkey);
if (salt != NULL((void*)0)) {
explicit_bzero(salt, slen);
free(salt);
}
if (key != NULL((void*)0)) {
explicit_bzero(key, keylen + ivlen);
free(key);
}
sshbuf_free(kdf);
sshbuf_free(decrypted);
return r;
4196}

4198/* Check deterministic padding after private key */
4199static int
4200private2_check_padding(struct sshbuf *decrypted)
4201{
u_char pad;
size_t i;
int r = SSH_ERR_INTERNAL_ERROR-1;

i = 0;
while (sshbuf_len(decrypted)) {
if ((r = sshbuf_get_u8(decrypted, &pad)) != 0)
	goto out;
if (pad != (++i & 0xff)) {
	r = SSH_ERR_INVALID_FORMAT-4;
	goto out;
}
}
/* success */
r = 0;
out:
explicit_bzero(&pad, sizeof(pad));
explicit_bzero(&i, sizeof(i));
return r;
4221}

4223static int
4224sshkey_parse_private2(struct sshbuf *blob, int type, const char *passphrase,
  struct sshkey **keyp, char **commentp)
4226{
char *comment = NULL((void*)0);
int r = SSH_ERR_INTERNAL_ERROR-1;
struct sshbuf *decoded = NULL((void*)0), *decrypted = NULL((void*)0);
struct sshkey *k = NULL((void*)0), *pubkey = NULL((void*)0);

if (keyp != NULL((void*)0))
*keyp = NULL((void*)0);
if (commentp != NULL((void*)0))
*commentp = NULL((void*)0);

/* Undo base64 encoding and decrypt the private section */
if ((r = private2_uudecode(blob, &decoded)) != 0 ||
   (r = private2_decrypt(decoded, passphrase,
   &decrypted, &pubkey)) != 0)
goto out;

if (type != KEY_UNSPEC &&
   sshkey_type_plain(type) != sshkey_type_plain(pubkey->type)) {
r = SSH_ERR_KEY_TYPE_MISMATCH-13;
goto out;
}

/* Load the private key and comment */
if ((r = sshkey_private_deserialize(decrypted, &k)) != 0 ||
   (r = sshbuf_get_cstring(decrypted, &comment, NULL((void*)0))) != 0)
goto out;

/* Check deterministic padding after private section */
if ((r = private2_check_padding(decrypted)) != 0)
goto out;

/* Check that the public key in the envelope matches the private key */
if (!sshkey_equal(pubkey, k)) {
r = SSH_ERR_INVALID_FORMAT-4;
goto out;
}

/* success */
r = 0;
if (keyp != NULL((void*)0)) {
*keyp = k;
k = NULL((void*)0);
}
if (commentp != NULL((void*)0)) {
*commentp = comment;
comment = NULL((void*)0);
}
out:
free(comment);
sshbuf_free(decoded);
sshbuf_free(decrypted);
sshkey_free(k);
sshkey_free(pubkey);
return r;
4281}

4283static int
4284sshkey_parse_private2_pubkey(struct sshbuf *blob, int type,
  struct sshkey **keyp)
4286{
int r = SSH_ERR_INTERNAL_ERROR-1;
struct sshbuf *decoded = NULL((void*)0);
struct sshkey *pubkey = NULL((void*)0);
u_int nkeys = 0;

if (keyp3.1
'keyp' is equal to NULL
 != NULL((void*)0))
4
←
Taking false branch→
*keyp = NULL((void*)0);

if ((r = private2_uudecode(blob, &decoded)) != 0)
5
←
Taking false branch→
goto out;
/* parse public key from unencrypted envelope */
if ((r = sshbuf_consume(decoded, sizeof(AUTH_MAGIC"openssh-key-v1"))) != 0 ||
6
←
Assuming the condition is false→
11
←
Taking false branch→
   (r = sshbuf_skip_string(decoded)sshbuf_get_string_direct(decoded, ((void*)0), ((void*)0))) != 0 || /* cipher */
7
←
Assuming the condition is false→
   (r = sshbuf_skip_string(decoded)sshbuf_get_string_direct(decoded, ((void*)0), ((void*)0))) != 0 || /* KDF alg */
8
←
Assuming the condition is false→
   (r = sshbuf_skip_string(decoded)sshbuf_get_string_direct(decoded, ((void*)0), ((void*)0))) != 0 || /* KDF hint */
9
←
Assuming the condition is false→
   (r = sshbuf_get_u32(decoded, &nkeys)) != 0)
10
←
Assuming the condition is false→
goto out;

if (nkeys != 1) {
12
←
Assuming 'nkeys' is equal to 1→
13
←
Taking false branch→
/* XXX only one key supported at present */
r = SSH_ERR_INVALID_FORMAT-4;
goto out;
}

/* Parse the public key */
if ((r = sshkey_froms(decoded, &pubkey)) != 0)
14
←
Calling 'sshkey_froms'→
goto out;

if (type != KEY_UNSPEC &&
   sshkey_type_plain(type) != sshkey_type_plain(pubkey->type)) {
r = SSH_ERR_KEY_TYPE_MISMATCH-13;
goto out;
}

/* success */
r = 0;
if (keyp != NULL((void*)0)) {
*keyp = pubkey;
pubkey = NULL((void*)0);
}
out:
sshbuf_free(decoded);
sshkey_free(pubkey);
return r;
4331}

4333#ifdef WITH_OPENSSL1
4334/* convert SSH v2 key to PEM or PKCS#8 format */
4335static int
4336sshkey_private_to_blob_pem_pkcs8(struct sshkey *key, struct sshbuf *buf,
  int format, const char *_passphrase, const char *comment)
4338{
int was_shielded = sshkey_is_shielded(key);
int success, r;
int blen, len = strlen(_passphrase);
u_char *passphrase = (len > 0) ? (u_char *)_passphrase : NULL((void*)0);
const EVP_CIPHER *cipher = (len > 0) ? EVP_aes_128_cbc() : NULL((void*)0);
char *bptr;
BIO *bio = NULL((void*)0);
struct sshbuf *blob;
EVP_PKEY *pkey = NULL((void*)0);

if (len > 0 && len <= 4)
return SSH_ERR_PASSPHRASE_TOO_SHORT-40;
if ((blob = sshbuf_new()) == NULL((void*)0))
return SSH_ERR_ALLOC_FAIL-2;
if ((bio = BIO_new(BIO_s_mem())) == NULL((void*)0)) {
r = SSH_ERR_ALLOC_FAIL-2;
goto out;
}
if (format == SSHKEY_PRIVATE_PKCS8 && (pkey = EVP_PKEY_new()) == NULL((void*)0)) {
r = SSH_ERR_ALLOC_FAIL-2;
goto out;
}
if ((r = sshkey_unshield_private(key)) != 0)
goto out;

switch (key->type) {
case KEY_DSA:
if (format == SSHKEY_PRIVATE_PEM) {
	success = PEM_write_bio_DSAPrivateKey(bio, key->dsa,
	    cipher, passphrase, len, NULL((void*)0), NULL((void*)0));
} else {
	success = EVP_PKEY_set1_DSA(pkey, key->dsa);
}
break;
case KEY_ECDSA:
if (format == SSHKEY_PRIVATE_PEM) {
	success = PEM_write_bio_ECPrivateKey(bio, key->ecdsa,
	    cipher, passphrase, len, NULL((void*)0), NULL((void*)0));
} else {
	success = EVP_PKEY_set1_EC_KEY(pkey, key->ecdsa);
}
break;
case KEY_RSA:
if (format == SSHKEY_PRIVATE_PEM) {
	success = PEM_write_bio_RSAPrivateKey(bio, key->rsa,
	    cipher, passphrase, len, NULL((void*)0), NULL((void*)0));
} else {
	success = EVP_PKEY_set1_RSA(pkey, key->rsa);
}
break;
default:
success = 0;
break;
}
if (success == 0) {
r = SSH_ERR_LIBCRYPTO_ERROR-22;
goto out;
}
if (format == SSHKEY_PRIVATE_PKCS8) {
if ((success = PEM_write_bio_PrivateKey(bio, pkey, cipher,
    passphrase, len, NULL((void*)0), NULL((void*)0))) == 0) {
	r = SSH_ERR_LIBCRYPTO_ERROR-22;
	goto out;
}
}
if ((blen = BIO_get_mem_data(bio, &bptr)BIO_ctrl(bio,3,0,(char *)&bptr)) <= 0) {
r = SSH_ERR_INTERNAL_ERROR-1;
goto out;
}
if ((r = sshbuf_put(blob, bptr, blen)) != 0)
goto out;
r = 0;
out:
if (was_shielded)
r = sshkey_shield_private(key);
if (r == 0)
r = sshbuf_putb(buf, blob);

EVP_PKEY_free(pkey);
sshbuf_free(blob);
BIO_free(bio);
return r;
4421}
4422#endif /* WITH_OPENSSL */

4424/* Serialise "key" to buffer "blob" */
4425int
4426sshkey_private_to_fileblob(struct sshkey *key, struct sshbuf *blob,
  const char *passphrase, const char *comment,
  int format, const char *openssh_format_cipher, int openssh_format_rounds)
4429{
switch (key->type) {
4431#ifdef WITH_OPENSSL1
case KEY_DSA:
case KEY_ECDSA:
case KEY_RSA:
break; /* see below */
4436#endif /* WITH_OPENSSL */
case KEY_ED25519:
case KEY_ED25519_SK:
4439#ifdef WITH_XMSS
case KEY_XMSS:
4441#endif /* WITH_XMSS */
4442#ifdef WITH_OPENSSL1
case KEY_ECDSA_SK:
4444#endif /* WITH_OPENSSL */
return sshkey_private_to_blob2(key, blob, passphrase,
    comment, openssh_format_cipher, openssh_format_rounds);
default:
return SSH_ERR_KEY_TYPE_UNKNOWN-14;
}

4451#ifdef WITH_OPENSSL1
switch (format) {
case SSHKEY_PRIVATE_OPENSSH:
return sshkey_private_to_blob2(key, blob, passphrase,
    comment, openssh_format_cipher, openssh_format_rounds);
case SSHKEY_PRIVATE_PEM:
case SSHKEY_PRIVATE_PKCS8:
return sshkey_private_to_blob_pem_pkcs8(key, blob,
    format, passphrase, comment);
default:
return SSH_ERR_INVALID_ARGUMENT-10;
}
4463#endif /* WITH_OPENSSL */
4464}

4466#ifdef WITH_OPENSSL1
4467static int
4468translate_libcrypto_error(unsigned long pem_err)
4469{
int pem_reason = ERR_GET_REASON(pem_err)(int)((pem_err)&0xfffL);

switch (ERR_GET_LIB(pem_err)(int)((((unsigned long)pem_err)>>24L)&0xffL)) {
case ERR_LIB_PEM9:
switch (pem_reason) {
case PEM_R_BAD_PASSWORD_READ104:
case PEM_R_PROBLEMS_GETTING_PASSWORD109:
case PEM_R_BAD_DECRYPT101:
	return SSH_ERR_KEY_WRONG_PASSPHRASE-43;
default:
	return SSH_ERR_INVALID_FORMAT-4;
}
case ERR_LIB_EVP6:
switch (pem_reason) {
case EVP_R_BAD_DECRYPT100:
	return SSH_ERR_KEY_WRONG_PASSPHRASE-43;
4486#ifdef EVP_R_BN_DECODE_ERROR112
case EVP_R_BN_DECODE_ERROR112:
4488#endif
case EVP_R_DECODE_ERROR114:
4490#ifdef EVP_R_PRIVATE_KEY_DECODE_ERROR145
case EVP_R_PRIVATE_KEY_DECODE_ERROR145:
4492#endif
	return SSH_ERR_INVALID_FORMAT-4;
default:
	return SSH_ERR_LIBCRYPTO_ERROR-22;
}
case ERR_LIB_ASN113:
return SSH_ERR_INVALID_FORMAT-4;
}
return SSH_ERR_LIBCRYPTO_ERROR-22;
4501}

4503static void
4504clear_libcrypto_errors(void)
4505{
while (ERR_get_error() != 0)
;
4508}

4510/*
* Translate OpenSSL error codes to determine whether
* passphrase is required/incorrect.
*/
4514static int
4515convert_libcrypto_error(void)
4516{
/*
* Some password errors are reported at the beginning
* of the error queue.
*/
if (translate_libcrypto_error(ERR_peek_error()) ==
   SSH_ERR_KEY_WRONG_PASSPHRASE-43)
return SSH_ERR_KEY_WRONG_PASSPHRASE-43;
return translate_libcrypto_error(ERR_peek_last_error());
4525}

4527static int
4528sshkey_parse_private_pem_fileblob(struct sshbuf *blob, int type,
  const char *passphrase, struct sshkey **keyp)
4530{
EVP_PKEY *pk = NULL((void*)0);
struct sshkey *prv = NULL((void*)0);
BIO *bio = NULL((void*)0);
int r;

if (keyp != NULL((void*)0))
*keyp = NULL((void*)0);

if ((bio = BIO_new(BIO_s_mem())) == NULL((void*)0) || sshbuf_len(blob) > INT_MAX2147483647)
return SSH_ERR_ALLOC_FAIL-2;
if (BIO_write(bio, sshbuf_ptr(blob), sshbuf_len(blob)) !=
   (int)sshbuf_len(blob)) {
r = SSH_ERR_ALLOC_FAIL-2;
goto out;
}

clear_libcrypto_errors();
if ((pk = PEM_read_bio_PrivateKey(bio, NULL((void*)0), NULL((void*)0),
   (char *)passphrase)) == NULL((void*)0)) {
/*
 * libcrypto may return various ASN.1 errors when attempting
 * to parse a key with an incorrect passphrase.
 * Treat all format errors as "incorrect passphrase" if a
 * passphrase was supplied.
 */
if (passphrase != NULL((void*)0) && *passphrase != '\0')
	r = SSH_ERR_KEY_WRONG_PASSPHRASE-43;
else
	r = convert_libcrypto_error();
goto out;
}
if (EVP_PKEY_base_id(pk) == EVP_PKEY_RSA6 &&
   (type == KEY_UNSPEC || type == KEY_RSA)) {
if ((prv = sshkey_new(KEY_UNSPEC)) == NULL((void*)0)) {
	r = SSH_ERR_ALLOC_FAIL-2;
	goto out;
}
prv->rsa = EVP_PKEY_get1_RSA(pk);
prv->type = KEY_RSA;
4570#ifdef DEBUG_PK
RSA_print_fp(stderr(&__sF[2]), prv->rsa, 8);
4572#endif
if (RSA_blinding_on(prv->rsa, NULL((void*)0)) != 1) {
	r = SSH_ERR_LIBCRYPTO_ERROR-22;
	goto out;
}
if ((r = check_rsa_length(prv->rsa)) != 0)
	goto out;
} else if (EVP_PKEY_base_id(pk) == EVP_PKEY_DSA116 &&
   (type == KEY_UNSPEC || type == KEY_DSA)) {
if ((prv = sshkey_new(KEY_UNSPEC)) == NULL((void*)0)) {
	r = SSH_ERR_ALLOC_FAIL-2;
	goto out;
}
prv->dsa = EVP_PKEY_get1_DSA(pk);
prv->type = KEY_DSA;
4587#ifdef DEBUG_PK
DSA_print_fp(stderr(&__sF[2]), prv->dsa, 8);
4589#endif
} else if (EVP_PKEY_base_id(pk) == EVP_PKEY_EC408 &&
   (type == KEY_UNSPEC || type == KEY_ECDSA)) {
if ((prv = sshkey_new(KEY_UNSPEC)) == NULL((void*)0)) {
	r = SSH_ERR_ALLOC_FAIL-2;
	goto out;
}
prv->ecdsa = EVP_PKEY_get1_EC_KEY(pk);
prv->type = KEY_ECDSA;
prv->ecdsa_nid = sshkey_ecdsa_key_to_nid(prv->ecdsa);
if (prv->ecdsa_nid == -1 ||
    sshkey_curve_nid_to_name(prv->ecdsa_nid) == NULL((void*)0) ||
    sshkey_ec_validate_public(EC_KEY_get0_group(prv->ecdsa),
    EC_KEY_get0_public_key(prv->ecdsa)) != 0 ||
    sshkey_ec_validate_private(prv->ecdsa) != 0) {
	r = SSH_ERR_INVALID_FORMAT-4;
	goto out;
}
4607#ifdef DEBUG_PK
if (prv != NULL((void*)0) && prv->ecdsa != NULL((void*)0))
	sshkey_dump_ec_key(prv->ecdsa);
4610#endif
} else {
r = SSH_ERR_INVALID_FORMAT-4;
goto out;
}
r = 0;
if (keyp != NULL((void*)0)) {
*keyp = prv;
prv = NULL((void*)0);
}
out:
BIO_free(bio);
EVP_PKEY_free(pk);
sshkey_free(prv);
return r;
4625}
4626#endif /* WITH_OPENSSL */

4628int
4629sshkey_parse_private_fileblob_type(struct sshbuf *blob, int type,
  const char *passphrase, struct sshkey **keyp, char **commentp)
4631{
int r = SSH_ERR_INTERNAL_ERROR-1;

if (keyp != NULL((void*)0))
*keyp = NULL((void*)0);
if (commentp != NULL((void*)0))
*commentp = NULL((void*)0);

switch (type) {
case KEY_ED25519:
case KEY_XMSS:
/* No fallback for new-format-only keys */
return sshkey_parse_private2(blob, type, passphrase,
    keyp, commentp);
default:
r = sshkey_parse_private2(blob, type, passphrase, keyp,
    commentp);
/* Only fallback to PEM parser if a format error occurred. */
if (r != SSH_ERR_INVALID_FORMAT-4)
	return r;
4651#ifdef WITH_OPENSSL1
return sshkey_parse_private_pem_fileblob(blob, type,
    passphrase, keyp);
4654#else
return SSH_ERR_INVALID_FORMAT-4;
4656#endif /* WITH_OPENSSL */
}
4658}

4660int
4661sshkey_parse_private_fileblob(struct sshbuf *buffer, const char *passphrase,
  struct sshkey **keyp, char **commentp)
4663{
if (keyp != NULL((void*)0))
*keyp = NULL((void*)0);
if (commentp != NULL((void*)0))
*commentp = NULL((void*)0);

return sshkey_parse_private_fileblob_type(buffer, KEY_UNSPEC,
   passphrase, keyp, commentp);
4671}

4673void
4674sshkey_sig_details_free(struct sshkey_sig_details *details)
4675{
freezero(details, sizeof(*details));
4677}

4679int
4680sshkey_parse_pubkey_from_private_fileblob_type(struct sshbuf *blob, int type,
  struct sshkey **pubkeyp)
4682{
int r = SSH_ERR_INTERNAL_ERROR-1;

if (pubkeyp != NULL((void*)0))
1
Assuming 'pubkeyp' is equal to NULL→
2
←
Taking false branch→
*pubkeyp = NULL((void*)0);
/* only new-format private keys bundle a public key inside */
if ((r = sshkey_parse_private2_pubkey(blob, type, pubkeyp)) != 0)
3
←
Calling 'sshkey_parse_private2_pubkey'→
return r;
return 0;
4691}

4693#ifdef WITH_XMSS
4694/*
* serialize the key with the current state and forward the state
* maxsign times.
*/
4698int
4699sshkey_private_serialize_maxsign(struct sshkey *k, struct sshbuf *b,
  u_int32_t maxsign, int printerror)
4701{
int r, rupdate;

if (maxsign == 0 ||
   sshkey_type_plain(k->type) != KEY_XMSS)
return sshkey_private_serialize_opt(k, b,
    SSHKEY_SERIALIZE_DEFAULT);
if ((r = sshkey_xmss_get_state(k, printerror)) != 0 ||
   (r = sshkey_private_serialize_opt(k, b,
   SSHKEY_SERIALIZE_STATE)) != 0 ||
   (r = sshkey_xmss_forward_state(k, maxsign)) != 0)
goto out;
r = 0;
4714out:
if ((rupdate = sshkey_xmss_update_state(k, printerror)) != 0) {
if (r == 0)
	r = rupdate;
}
return r;
4720}

4722u_int32_t
4723sshkey_signatures_left(const struct sshkey *k)
4724{
if (sshkey_type_plain(k->type) == KEY_XMSS)
return sshkey_xmss_signatures_left(k);
return 0;
4728}

4730int
4731sshkey_enable_maxsign(struct sshkey *k, u_int32_t maxsign)
4732{
if (sshkey_type_plain(k->type) != KEY_XMSS)
return SSH_ERR_INVALID_ARGUMENT-10;
return sshkey_xmss_enable_maxsign(k, maxsign);
4736}

4738int
4739sshkey_set_filename(struct sshkey *k, const char *filename)
4740{
if (k == NULL((void*)0))
return SSH_ERR_INVALID_ARGUMENT-10;
if (sshkey_type_plain(k->type) != KEY_XMSS)
return 0;
if (filename == NULL((void*)0))
return SSH_ERR_INVALID_ARGUMENT-10;
if ((k->xmss_filename = strdup(filename)) == NULL((void*)0))
return SSH_ERR_ALLOC_FAIL-2;
return 0;
4750}
4751#else
4752int
4753sshkey_private_serialize_maxsign(struct sshkey *k, struct sshbuf *b,
  u_int32_t maxsign, int printerror)
4755{
return sshkey_private_serialize_opt(k, b, SSHKEY_SERIALIZE_DEFAULT);
4757}

4759u_int32_t
4760sshkey_signatures_left(const struct sshkey *k)
4761{
return 0;
4763}

4765int
4766sshkey_enable_maxsign(struct sshkey *k, u_int32_t maxsign)
4767{
return SSH_ERR_INVALID_ARGUMENT-10;
4769}

4771int
4772sshkey_set_filename(struct sshkey *k, const char *filename)
4773{
if (k == NULL((void*)0))
return SSH_ERR_INVALID_ARGUMENT-10;
return 0;
4777}
4778#endif /* WITH_XMSS */